Extracted

• • Target

    DEKONTU.exe

  • Size

    1008KB

  • MD5

    5f7700145f1cc51409e66bc4572bfe29

  • SHA1

    c56cfd66f3c796262013bf5c2ecb31a77e060bed

  • SHA256

    7d90f4b1e9a959b95cf1ee34ca507697cd07f786042206470c5e049a034fc44f

  • SHA512

    d6e883d758a85b5357b23764fd13bbc3a1561f50a1f38b1d96fff4f408e86a875bd8f5f271868e0225576bc43b13dd643d02871d271f180b067c924e04ef54f3

  • SSDEEP

    24576:2u6J33O0c+JY5UZ+XC0kGso6Fa6tzqaPL3leWY:Yu0c++OCvkGs9Fa6pY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2