Extracted

• • Target

    c1a3c8b96c797a19a876296759b5e08668d1d25c46835d70c84ba4d231c06572

  • Size

    1.1MB

  • MD5

    283d763fb0c4deb624bf3aac10933b3d

  • SHA1

    0833290e97fe557b9cd95ffd6a3636fba2346635

  • SHA256

    c1a3c8b96c797a19a876296759b5e08668d1d25c46835d70c84ba4d231c06572

  • SHA512

    7bfe1e015c003f96b6f42b66e666f5002921e4f8b95be76513d43d112c03e498e4ee9916e014759dbd7ed0feef46619f3ff40fcc6b3995ac852312cbeba7ef1f

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLezVFkYI995ujlDq02DMUc:f3v+7/5QLe5qYg2hGoN

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2