Extracted

• • Target

    4b8c422424da67396c509a69146fea0c028e4a85994413205ae933c4a9a5bd5d.exe

  • Size

    969KB

  • MD5

    ecedaaa41831352c70c85513830d50cf

  • SHA1

    5e8090d8c9f963a90c168ddf5c2d565f51d17401

  • SHA256

    4b8c422424da67396c509a69146fea0c028e4a85994413205ae933c4a9a5bd5d

  • SHA512

    fc00197ff690bb19f5adf04ae35a3087f48d5c18f563361e60f0556199b4821a089f32cdfc01e016b5fc4ed2d0b1e867a66a5dc3e028879085c4aae028f98c17

  • SSDEEP

    12288:SAeY2iNw0+9MKxtofaDnpDjfJSn4TYyBd+Bk8ADqjJ5np5W0xAJRNLoHYqHpO5CD:SAJ1Ielq7JSnHuijr

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoveryevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2