Extracted

• • Target

    98ad6abcac89f5fe797e52b948b022c86b77960d89d0d0c08a74342e4ab2d0f5

  • Size

    1.1MB

  • MD5

    99ca910b16db27ba66db9cbec2415cea

  • SHA1

    cad321a828e9a42d6487be7bff031470cb06080b

  • SHA256

    98ad6abcac89f5fe797e52b948b022c86b77960d89d0d0c08a74342e4ab2d0f5

  • SHA512

    b0f2517ec1fa23552c0adfafc6fabbb22c491cb8071fb4a1028c94e36e6c54b25ea00dd2d3e34f306f105c7df9d15f8f58ab7f8f5d7ed9b913ebff4a87a6065b

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLrqN39nuk3kDWKOQsZkDpI:f3v+7/5QLrqNtuJaKOQ0kDpI

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2