Extracted

• • Target

    a34887afea413ee213c59e09cefd8343dd9c606c2c5c41022707412788fafe52.exe

  • Size

    978KB

  • MD5

    53699fc6f42ae5922ed39558c20e5a49

  • SHA1

    1ca134a30c20b59faa40d0ff423b0097ebffc890

  • SHA256

    a34887afea413ee213c59e09cefd8343dd9c606c2c5c41022707412788fafe52

  • SHA512

    45b164e4eff353b29b0c2308536d24e42c943b313f564964051dd21d0248d0b58ae1ece11dd99cab5470742b81afc9702f6647a3329486765e4d225edc22df0d

  • SSDEEP

    12288:Jtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgafTBi+XQFdYEyc6A:Jtb20pkaCqT5TBWgNQ7a7BTg7Yxc6A

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2