Extracted

• • Target

    46c26cc083a8e984e06a2e1e670487f60e1c340b819ce566ca349ca04d01ec32.exe

  • Size

    478KB

  • MD5

    afdc908cc5972fc98ea8d8c1ec6a1a20

  • SHA1

    2a53ca86feb606238bfc1e0d33e18560b198a069

  • SHA256

    46c26cc083a8e984e06a2e1e670487f60e1c340b819ce566ca349ca04d01ec32

  • SHA512

    03ba6516cf7b27ace802c35a0129eebe0d21bebb38cecf46875883d71d0f6253c9748fd7fb1e474e74049c752382fc111e27f037fbaa32ab7c1a8856e80270cf

  • SSDEEP

    12288:ams10/1QwuU3B+WoJwqIQXuYc8AbiRR7EujnkmHs+ElAdV/feinF:aS1XzR5ouqISAGzf/feKF

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2