Extracted

• • Target

    2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413

  • Size

    948KB

  • MD5

    1a74c66d4750248af37fe8cb959560cd

  • SHA1

    8d4de0fd49e567ed59ff6e0efb62ff43de76e841

  • SHA256

    2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413

  • SHA512

    5b7cb8215e5b089c16bdb27207399ba2f059862272f8e4125858940a910581e48c7ade8c9c0fca2bc9ce13c06a76692da582c5246ec9add660ff96420ff48874

  • SSDEEP

    24576:sGF+CJcIc+trkIpbcf1luQnZ/uzzFxiXKjoeKxEfDhI5/3:DxcIfrxC1EQZczFoajoeKic/

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2