Extracted

• • Target

    SOA Oct 24.exe

  • Size

    1.1MB

  • MD5

    10169da08bb0f39076b33dfbd5ff8bcd

  • SHA1

    7867e87076e8cb3f160ad91c28d48a15ce573174

  • SHA256

    da468beb20714dfb771a050b460cf9a00e2123a6a05c19f67a20242cb5d37b0d

  • SHA512

    1ce4f6cf44dbe682f443795d9e8f46bf22b2e6482fbe01cd1d6bc8547c9e157cd7185ca868d7c01fc0531ccec915ab994f381e6b045abdadfd78e023b953b0eb

  • SSDEEP

    24576:ztb20pkaCqT5TBWgNQ7a2Eu9icOzK3+3kkz6A:wVg5tQ7a2EnT+O0+5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2