Extracted

• • Target

    527e10d1b5cd79a9f7d180e0e7344567d919cb9a4a69532c91e86eff39bd2152N.exe

  • Size

    477KB

  • MD5

    abb2d0f448e731a4da6e28d1dc032c60

  • SHA1

    72cf3a027be2e5aa7bc1566b5a30015cbf61c89b

  • SHA256

    527e10d1b5cd79a9f7d180e0e7344567d919cb9a4a69532c91e86eff39bd2152

  • SHA512

    5bc6b917a3b5f56404181acc813649eed07ce235aa0f369103ac5a7ed27c186774ee23a4f241c077175ef103920510ad7eafaeaf40109dc9e684a1009175e010

  • SSDEEP

    12288:37apunYNGMaM6LEb+areYkMeKDDHovb7LHOXm/4RWa5GrKU6:3Opune6AvrIvbnHO1mKU6

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2