Extracted

• • Target

    c7e741dba8e474d826781462c684f58c55d22bdab512377a37cef17694a88285

  • Size

    484KB

  • MD5

    85d83148598fda2d40262bae27220a9a

  • SHA1

    853ac6c8f88e6b59fa68940e08b8d39ccb1fd1d4

  • SHA256

    c7e741dba8e474d826781462c684f58c55d22bdab512377a37cef17694a88285

  • SHA512

    093ab4251abc876db5e9134a0cec8aee999c6501d55efd0a4d91d1d9d9ff998aee41a047cce7567a83652cf8311c19b1d10046eac52a0bdbddaf70c441f02292

  • SSDEEP

    12288:C3yti4hJw4j0lTKsczeHhu2VkPC19ZcCRPT5p/o4CG:Q4DZfsczeHQ2y6DqeH/oxG

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2