Extracted

• • Target

    6cff924b5be424a4d1bed9ff2a570b1908064f2719b279b4361fd8d833b45808.exe

  • Size

    130KB

  • MD5

    65ff3f25d4818c060a0a160375e7b740

  • SHA1

    85c12c22db8ac4b030c3f729c3ddd2f54db391e1

  • SHA256

    6cff924b5be424a4d1bed9ff2a570b1908064f2719b279b4361fd8d833b45808

  • SHA512

    c763100042228d232d4cc4db53559ca1e736a05e41dfc2835c4f91584d3cd2c8c631aa918cb068353206f09dbb53066fcdf525fe65f3e646f49271f3e7736fee

  • SSDEEP

    3072:1vDdI8Ca564+4V4v4z4G43424A464y4K4v4f4u4A494V4t4w4H4j4Y4Y4s4P4W4J:3IxaVbd23zb

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2