Extracted

• • Target

    c27fdfe178919b9cbd02a634d6f7ec9d86c6a16c9b249ee49fd182904fd402d9.exe

  • Size

    415KB

  • MD5

    ad16c932e217add47fe812543f96735d

  • SHA1

    6033eed876a8d948aef8ff497a0e7dc606885819

  • SHA256

    c27fdfe178919b9cbd02a634d6f7ec9d86c6a16c9b249ee49fd182904fd402d9

  • SHA512

    58c3b7473de0bb7321e07c4e02b46f3e4190722b4b55399d0b19cf1fe9bad03ad5c0c0c0bcd16d6af5a3ac34df88efba58dd69088b36b48323d7c183678af7ea

  • SSDEEP

    6144:YtgFVwrhUEz+16Uqd2GhN+qQcIkG5we2oXitAQ1CZu6GxOeUQuKrDxl16Fwa:Ytgw7z+sUi2iNtfdMityZ79dQuktlIF/

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2