Extracted

• • Target

    4d9269d0c5706adc5a898408e788b15e5cdf9e490ccdec4c52aec64b8f8c63a2.exe

  • Size

    546KB

  • MD5

    0f84f8f18907b23ecde50b2b7025f5fb

  • SHA1

    5a1286f0e3cd47e365e250fce43f0cc3bd53a818

  • SHA256

    4d9269d0c5706adc5a898408e788b15e5cdf9e490ccdec4c52aec64b8f8c63a2

  • SHA512

    4ee294079372694ec9e9eda80ef23b5384bfc172f6d55dcd55407704b82420cb728973de3d4e4306fbeaaa31446e9d10f6bf0f218787b9959fc44026d334ccc9

  • SSDEEP

    12288:WMyCaKNF6Z6YtzjuKNoWTwHBgaSf0XThDVwoBkHZzD:WMytxZ6Ytzj9mWTwKaI0NhnKP

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2