Extracted

• • Target

    2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9

  • Size

    603KB

  • MD5

    4d74cebd8ddaae78de8144f1abb245e5

  • SHA1

    8e8423e4af53a91b9750014235773f9ec38916df

  • SHA256

    2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9

  • SHA512

    db4959b2a762416a62fc95fd06c5b5836189ef6e785cfaaaa2e26e28602a8db2aa71893dd72833490cdf631321ac6c7ab5a168bbf671dfa1bb98ab8c827d3426

  • SSDEEP

    12288:fYVqW8F9057V2WnuYJBcw/6oxYP4Tl9SZZGQ4qS6q:rLs0WnuYP6KeokZZGdqbq

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2