Extracted

• • Target

    e2de1ffb7c17b005edd68f2cbb7be222c4cd5d31ed4a8016e00352d710502830.exe

  • Size

    445KB

  • MD5

    ee3c556aefe890e9c105dcdb2a868bad

  • SHA1

    505a2eebfeaf5455d2730a1d951be76b6e3b094d

  • SHA256

    e2de1ffb7c17b005edd68f2cbb7be222c4cd5d31ed4a8016e00352d710502830

  • SHA512

    1b3121797d362087b3ef81958e85de571fdf869876f8e98382b6f43a290e778134eb3a733cad8ed19bb1aa568b7f57ccaf0035a5d8a23acee19ecf3ec8be3720

  • SSDEEP

    6144:8GxhLHI5iv1zNXtHA0tMXgC/pN0LUkQpzY7twmHaqzJG/RN/g:VwsXtHA0At//kQpMtDHaqzAT/g

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2