Extracted

• • Target

    ee8e3d37fcdeb4590b376bfa53991c9163427a76caea07c32215c8e34a823320

  • Size

    575KB

  • MD5

    0f37be8985e3940af919dc35bc4ed779

  • SHA1

    2f2a27ec8a249cef7058f9d7a425f8817e67445c

  • SHA256

    ee8e3d37fcdeb4590b376bfa53991c9163427a76caea07c32215c8e34a823320

  • SHA512

    feaf50abba44f44e272a96690e552bcd960a25009ca20a1bec98d6064dffb749fe0d436892bdabd69d6233641afa355b70a36e9ae2faac282295b6e4efff07dc

  • SSDEEP

    6144:NzYBCPvubUOZoL9xh8+62h6vfrxaj0cdJHqBdqOtNYrrDduA49jTr5Mv0eYvw0Xl:xPG7MAqtO4PDkdjn5Q0G0Xl0Vcu9kR

  Score

  10^/10

  discoveryexecutionsnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2