Extracted

• • Target

    13cb2135790780947be355c3c9ed42be1987c9e64d6cd0c43a5a4c5ae289dc30.exe

  • Size

    1.0MB

  • MD5

    2ed7362e959d42385d4e6d231a6840dd

  • SHA1

    b3cc47ac92296d978fc991d9658c771f225dbf18

  • SHA256

    13cb2135790780947be355c3c9ed42be1987c9e64d6cd0c43a5a4c5ae289dc30

  • SHA512

    66553bb74d63e2d8bb47751f87f93dee66c4acbe647115dea5148d6b301f0a6802ae972a3fc26c1bcf9412775f1fbfd6238c1b477f726e0386cdef183551b758

  • SSDEEP

    24576:AY2YACYOYGYAAYAtY0YHYAkYAtYJYAAYoYA2YnYAqYDYAHONafeTZce9rlmxTfgX:UfeTZcYhmCBqKzSdG

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2