Extracted

• • Target

    899dc226fa35da5923b2c6e6e0b90834dd1ea0b4d2e156a6bc99acd1a183a2d4

  • Size

    130KB

  • MD5

    fd4302cdfacbc18e723806fde074625b

  • SHA1

    6d1d8197029f5d5f0ad961178db8574fefb7a65b

  • SHA256

    899dc226fa35da5923b2c6e6e0b90834dd1ea0b4d2e156a6bc99acd1a183a2d4

  • SHA512

    a2f2bc0ca6b815545062c1c5536e858a9eda7ddca0fa4bc4905bb99f0451111ebe7e5a28f59cbc1abc782c8e6c7c8f2d9108eff2f6da5c2afec08c7b52ff34aa

  • SSDEEP

    3072:d+XlnyGeKXVgLNIv4eYb5NtNsLEqwvxdqgbY:GnyTk49bvLzb

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2