Extracted

• • Target

    425b19b27a22ebeb6c36992870ee88119b4996086c3cfd1c64e1d7fbc330d0e8N.exe

  • Size

    985KB

  • MD5

    24b3090f4c1676070ce1ae5c832326a0

  • SHA1

    4f403a5f7db8c2cb0685e25ee826831cc54d81a0

  • SHA256

    425b19b27a22ebeb6c36992870ee88119b4996086c3cfd1c64e1d7fbc330d0e8

  • SHA512

    c65f1cc8192c12e65c75817238cc6d5999993155865e436b88c5f4f7c0825b5711844abdfadee84dcc2f76e8657b856855c054f528bf352ae11b2f7ebc4967d5

  • SSDEEP

    24576:Cu6J33O0c+JY5UZ+XC0kGso6FaWElfCXR2FsVWY:ku0c++OCvkGs9FaWWfA4Y

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2