Extracted

• • Target

    e4aff692493e83f70acd3cb69f0ec7e6ed6403d83d7e0c39eba8de9d3b3c732cN.exe

  • Size

    1.1MB

  • MD5

    369732cfe23b5895c4630ea251064030

  • SHA1

    adef16faa6b44be078fe2e25d397119c74d9a552

  • SHA256

    e4aff692493e83f70acd3cb69f0ec7e6ed6403d83d7e0c39eba8de9d3b3c732c

  • SHA512

    315341c5470a32a219c45f88b4832bece764c472a0ef5258117d1d11989b0b92c41de3d0b7a02be5289aa2d1ed59f4b40183a5a7e8094c4db07f6d3fbfa9f4f7

  • SSDEEP

    24576:mRmJkcoQricOIQxiZY1iaI9tlvQEWYnfHYHfHbo5:jJZoQrbTFZY1iaI/N4WvYHfHbo5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2