Extracted

• • Target

    ceec7cb5e407b39b3f23660b85ecdb002daf81f12ea8dc5e04d2992faef13511.exe

  • Size

    477KB

  • MD5

    f9d6484bf278cb574b66a897200a052f

  • SHA1

    ddf4b802cc24da590663af0da21084c0f75ccc96

  • SHA256

    ceec7cb5e407b39b3f23660b85ecdb002daf81f12ea8dc5e04d2992faef13511

  • SHA512

    461d35dedcdd3356ffff1f2301da893a0dcc35f117439f32e6bbf29cf6ee820b000237167aea62e0ef8fcf8632d856c260c60691e3d4171fff582e2f13581c30

  • SSDEEP

    12288:37apunYNGMaM6LEb+areYkMeKDDHovb7LHOXm/4RWa5GrKUq:3Opune6AvrIvbnHO1mKUq

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2