Extracted

Extracted

• • Target

    d1aca1896611f99b17a4a164393fa5decac29abbb3be0cd55e79587e703daf7d.exe

  • Size

    548KB

  • MD5

    b7ae929645f84ccef7b887d7d5c69b59

  • SHA1

    04495d161d24102317fe4ea444bae295d4a459ff

  • SHA256

    d1aca1896611f99b17a4a164393fa5decac29abbb3be0cd55e79587e703daf7d

  • SHA512

    2b13e8774cda99e1641a6cc143018cc7084847dfce047ac9c05d4e5bf60a8f7945d0dad93397c45a0223d4933f502b03ae8b84135b7680012cefd01bf6485036

  • SSDEEP

    12288:HD7go7VIG3k0MOdkrUC85KbIvXP5LWNSRwHbn+EgXkCkygA:HDEo7V/F5daB5bIvf5LiHb+xkCknA

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2