Extracted

• • Target

    1c5177fea4833f66ffe8c08a395dfd946c84d0e18aec8081b575665cec967e43

  • Size

    1.0MB

  • MD5

    68d0e288370f9f7248146514b7d23dc3

  • SHA1

    c8fca68e372791886859b45adb41ab894c15dbef

  • SHA256

    1c5177fea4833f66ffe8c08a395dfd946c84d0e18aec8081b575665cec967e43

  • SHA512

    2f6a36889efc28ca77f132555ee9202c05b40f9b024994db77c2a06668b3b4f2ad5c05f8a9aef32c73d1a4ef0f513b76841637dbfc38a82bdbc314115efc2d2e

  • SSDEEP

    12288:/tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaBh8iVhkW+ZWBmG0DuGo:/tb20pkaCqT5TBWgNQ7aBFGZ80D746A

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2