Extracted

• • Target

    coxmdihsb.exe

  • Size

    1.4MB

  • MD5

    0ad583952046482be518f880ecf6fc6d

  • SHA1

    bd77f47b9568e46155d803bfbc3ce03dabce5f61

  • SHA256

    7a763de7fba68aba15ca55d1af49263ff9973d43d35360d979ef1e3ed1abb2ab

  • SHA512

    c7dc2abc51154919ad8b2c11693acce4d611a664d7d6664e13f84e502411ddab54123710ab438a5bef71c38ef82074ebfcc31db50506827e81128b16a3655b44

  • SSDEEP

    12288:WL4iciUBGN6re5GGyaXYq9Nck2pm2SXOsREj9LnST7I1B:WyiP2xbaoENck2cR+Fd1

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2