Extracted

• • Target

    4c70310a239bb05c148151740e3cbccf787c13a33c6f9f5a8f9c75216ed43af4.exe

  • Size

    2.2MB

  • MD5

    744261ecea7819afad73c744b60b7e93

  • SHA1

    e6c2e03d6468b0193cc326fc52746063e937172b

  • SHA256

    4c70310a239bb05c148151740e3cbccf787c13a33c6f9f5a8f9c75216ed43af4

  • SHA512

    8f8e49f2834024a93e3c9a4d0b4316814455e81ae737ffee1b55cff4f4189c7daa480d8da163f484ac51d8333f1221ebcbfaee4d585044a955caec4dd88365de

  • SSDEEP

    12288:gOt1G044leEK+3ExXvA8fR5mPVr7iG2eXNPnrEdrEw:SLhEK0q/A8fR5mPVr7iGxXN/odow

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2