Extracted

• • Target

    cb49afa9e570e7d73b2d4dd8d53d7bc4a3bb12e2969cc96725dc8d47656c2ae8.exe

  • Size

    531KB

  • MD5

    961067bea5cf02f740a49ba9022d8dd3

  • SHA1

    c4962332eb8c041446417095be2c5e7f86788e08

  • SHA256

    cb49afa9e570e7d73b2d4dd8d53d7bc4a3bb12e2969cc96725dc8d47656c2ae8

  • SHA512

    c6d3d4b64861260981c5e0ee5c2737dac02c4f866b3f52880560874c9f0ed4f9953a7701114f740efbc6802f025dfe01d5633324f4077939441c0d2adc5b513e

  • SSDEEP

    12288:GAj/s0yek+BBlUVh+Z0D8MWoftBOMTCD8ztwerE6H1nN/:5a07UtYAFJe9qZB

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2