Extracted

• • Target

    79cbdad7c69186ea98b25a192c3210a0fc1c52fbbc341ab14a1b458f530cad80.exe

  • Size

    1002KB

  • MD5

    9e6efd68f14336b485fb55bd4f783283

  • SHA1

    438265afb6550f43a63b6ef9a2d918a6a3de9945

  • SHA256

    79cbdad7c69186ea98b25a192c3210a0fc1c52fbbc341ab14a1b458f530cad80

  • SHA512

    5ad2e093f2580d51f8e6459a8977737f141d5a35e801b4fd3d9343f0daa374ec7a4adaf408fb261426cbb18189cd9e75a0fe89c2915cfd37aedee2c2f9cb8616

  • SSDEEP

    24576:cu6J33O0c+JY5UZ+XC0kGso6FavKDzdOWY:Gu0c++OCvkGs9FavKDzHY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2