Extracted

• • Target

    0d819dfde6a1573f3b2a21f057c95d74d3cdc435c9b3bcd6fd57eef018dbc55aN

  • Size

    591KB

  • MD5

    8d6f7f5d651688062c1a67d217edfee0

  • SHA1

    4bd2f7afb5a33ce1a8776d1052eb72e4207d6ec4

  • SHA256

    0d819dfde6a1573f3b2a21f057c95d74d3cdc435c9b3bcd6fd57eef018dbc55a

  • SHA512

    fcecd5dc4d9a5f47c2e47b6ebba88e4cd2399ef7e78e944dc27ecdddee403e61ef28e9b155332b33e42dce4b13ac170a03a5b035c878d927965ec727cfd2929b

  • SSDEEP

    12288:1SaDPw1Qk89Tmyc5sar7Q8LxLSzs1tHT0JCTnQlJrr5cPMH4au2c7MUbkR:1XLw9gTFFz8tSzSNT0Jen0i0PuZMU+

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2