Extracted

• • Target

    8764a4a7a61aa1387c3e99200d8c35c89d0723e3e489da7abbb76559ac543deb

  • Size

    1.1MB

  • MD5

    3571899088d957a98acfed92f4ba81fb

  • SHA1

    18bf2cea74a8ab4d8d7b2511788a678dd858c413

  • SHA256

    8764a4a7a61aa1387c3e99200d8c35c89d0723e3e489da7abbb76559ac543deb

  • SHA512

    8e9f0d82ba8cb8e65c90555fa5e513c7c5b6f39c867ab29af25fe03e36cbb94653e2df2e146ce58fd7dc7da29291387e7fb7315813c4b314fb24a2c82521b545

  • SSDEEP

    24576:ttb20pkaCqT5TBWgNQ7a78L5X6wviN6A:eVg5tQ7a78L5zG5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2