Extracted

• • Target

    2b72e1cae965997ea7c5613ce0a3f5463bf5fd5afd41be8dd4bf339ac31e9465

  • Size

    1.3MB

  • MD5

    41f94a2922f60e3f0cdd9d1725b6c4ba

  • SHA1

    fc13832ecd4376a29fe17ba084b4e14bcc0f38e3

  • SHA256

    2b72e1cae965997ea7c5613ce0a3f5463bf5fd5afd41be8dd4bf339ac31e9465

  • SHA512

    b4fe70f9c4bc259e3e60ffff4c38380be95d5ae54e979f1a984244501162d9248acc780ab3efe263c78861cb38e0515f9a4324ce1f989e129cc70e897a07e785

  • SSDEEP

    24576:C/44oDaSKj+Cg0bueqz0HarxPIKEg6YW+4Xj4HxB0J4H444l:e4jahueerCKZ6B8Hx24H444l

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2