Extracted

• • Target

    c6a4e0fa597caf6381635be6ba6211ccb2c5d7161402e46128124c26750b945c.exe

  • Size

    576KB

  • MD5

    d75592cbb9d3ba728f0b27ad6218152c

  • SHA1

    549930cb2a9dc576c4f831793d8e29957d070551

  • SHA256

    c6a4e0fa597caf6381635be6ba6211ccb2c5d7161402e46128124c26750b945c

  • SHA512

    346fb36f74267d137173cb1e8838742fe1e595d29e7200f93943949c4331c0eb142f07cfc0a74874a697621603e4c62e78396865ae5da9c5f0f7c3bbda431e25

  • SSDEEP

    12288:wPG/+BUGJFwnne07Eke5eFGT1gWOlMNTaQzzYW8eQeoEbkR:faUUwnne0fe5e01gWBNTRcW8eQeoE+

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2