Extracted

• • Target

    8eedf9b52ee1d568c848fbb5c15b0f20bebd0433919b7890f24a6ae61cf9a8ff.exe

  • Size

    638KB

  • MD5

    b724bf637c848bc95d433ec5d6b5cc0c

  • SHA1

    cf6b7a922cc27982d4f153a7cfdd832671e836b4

  • SHA256

    8eedf9b52ee1d568c848fbb5c15b0f20bebd0433919b7890f24a6ae61cf9a8ff

  • SHA512

    3221c9ece2ad2bae3b6c0dc49dcb3026dd20a2725b2ceb74fa352ea744da46133f84fbc621abf858435b9a68af495b2505ac3f743c56c97d38e912073c2132c1

  • SSDEEP

    12288:FHuE6AAhZE2I8KwfcjmAkkpZ+Ho/fOicOoCGxLuyNT:YXZEKdfJAkaZ5tcT

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2