Extracted

• • Target

    17baa89155bed6a28e6051b219fac2d6e38099225c1e4a9ecd3e3e34d237e32e

  • Size

    1.1MB

  • MD5

    de3d16ec947654cf3c1e339110db19aa

  • SHA1

    46a2ae8cb82b6c7c56637a64d61634b246df9410

  • SHA256

    17baa89155bed6a28e6051b219fac2d6e38099225c1e4a9ecd3e3e34d237e32e

  • SHA512

    981d3d9f41b8fcafb4baa5887ba558a9e7e70057a76d74847f74ec911ee07db664c5d674d306dad1f34b2dcf60d446926da547064112d2d35c22706af8627fb9

  • SSDEEP

    24576:mRmJkcoQricOIQxiZY1iaI9tlvgLMjBWqxdhKL0u:jJZoQrbTFZY1iaI/NzBWqThKLJ

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2