Extracted

• • Target

    Dotc67890990.exe

  • Size

    1.1MB

  • MD5

    cc9b17d7e2fd4cd0150c27eb6aa57b74

  • SHA1

    3eed0a0e06be6d082e3965545ef367a7a6694d68

  • SHA256

    58cc97c8ec91ff5751fefc5eb22620f80c05b1fc81b7447d8475c67b31b4e4d2

  • SHA512

    b3d35f5cbca4865bbb839321715b5a55d4f5be39ed75a7bde8536fda4012c002c8a86c91b26b78633bc294aeb1d63a7022f384a1dbfd0fdb015fb0ac563c4bfa

  • SSDEEP

    24576:iAHnh+eWsN3skA4RV1Hom2KXMmHalntScQWro5:lh+ZkldoPK8YarS2y

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2