Extracted

• • Target

    b6ad170d197d557e308b9356d0f87653eb463cf74a48cbb50ce74c7260c315c2

  • Size

    1.1MB

  • MD5

    011f3bebde38bdac8ceaebfbff201f4a

  • SHA1

    bb5769d029c5f202e823e038aab2aae454cf0299

  • SHA256

    b6ad170d197d557e308b9356d0f87653eb463cf74a48cbb50ce74c7260c315c2

  • SHA512

    161838d1df3f6b7d7c2d61f98fc5fc55a30281e24433a5fc49a52aad0182bd5c5d581ba294c2a96878d93dc8536499d79a08f8aac879dc0eb5bee7f46b429cdf

  • SSDEEP

    12288:a93TVasGFa3nj6mYdrlXeohkdm8odEH8o4+AJDYv+6c0xlskR:a9l53jVYRXebsf19DEJ/

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2