Extracted

• • Target

    22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de.exe

  • Size

    630KB

  • MD5

    70289d25b830cd80af41120874eb1ee1

  • SHA1

    ac76af075b1dd893200d57e6e9a3f7b24d476488

  • SHA256

    22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de

  • SHA512

    40c245c8bc5cdfd169abc4e7daadc7f90493a27cda447f27d403552600a33a72f754c478495ca98259e071113f4521423d18bcf1cca7c70eae82216a48d4440f

  • SSDEEP

    12288:F3QiGR0dBOzDiCk5mQ0LnQyxzERfZ7sXmGUoFmz0WCJVMRsK:VoAOzHQ4nPzuZ7s27Im7CJVasK

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2