Extracted

• • Target

    SOA SEP 2024.exe

  • Size

    1.1MB

  • MD5

    3463c053c39de2170aa78b8aa253e999

  • SHA1

    e40e4169c635a3a34acb63928ad2ce89089a52fe

  • SHA256

    4b53b5e5756b9b3f43e32650b65590d0fe529e653a469b361df4bcf710b4e943

  • SHA512

    6a6a5376213f65070e5160ba34f7a7e3f44dc6c8e0e9f8205c3d5ba7dd402c0a372d42dd3a2899f7fce4eef3e5d879d64f41246d7a5139785278935e7315d82c

  • SSDEEP

    24576:htb20pkaCqT5TBWgNQ7aMqEpVK5aXVF6tw6A:yVg5tQ7aM+5KIW5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2