Extracted

• • Target

    ec0be7b7b2dc0a162eee2673bb94370a8b7eef222856ceeed9126f123050d1fb.exe

  • Size

    650KB

  • MD5

    f41ef066384697b9536cb2a2ceb52597

  • SHA1

    1a67aae992f751da11f38216c7acc21d49baaa50

  • SHA256

    ec0be7b7b2dc0a162eee2673bb94370a8b7eef222856ceeed9126f123050d1fb

  • SHA512

    8604d0950a69dc393c2fb50b73a47e8bf1762c95ab355beb1b1f48af9bf2d946dae2c74bb30b2a884551b26058b84e6e9a432fede668ed265091fc4fbc18372e

  • SSDEEP

    12288:uSiZM/U057k2tnu6gTf+8iAQ/z6KVrEQSjb:8Ctnu6gtiPr6qox

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2