Extracted

• • Target

    bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb

  • Size

    1.4MB

  • MD5

    a7eb6d75e2e1650b770659935018365b

  • SHA1

    ea305bbda8b4a94cd46c85b322c058f52a3b41f5

  • SHA256

    bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb

  • SHA512

    3487eb0baf2ecb908f2edd65049e1ed0107c318bacb85755e51aa836268f50c7695759d0e165492bc20bbe808337e36b6daf25efb5f7abf4811c16baf6291f5b

  • SSDEEP

    24576:5eyolA3YuCbH7J2Urh6TEJ1Z3PYEAmje+LmSWGn0o5I2W+uJax08B:x3fq0UrhQEJ/MX+x0UIS

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2