Extracted

• • Target

    file.exe

  • Size

    592KB

  • MD5

    67b58449b42453f18e51b2bf786f9588

  • SHA1

    9259537c4caa90a7b32c1370af18d40b2f24d0c9

  • SHA256

    4179ed7da1bcadc909d949d5721807d0eb0098375bc443f22fb70609927d254e

  • SHA512

    27e83950d69d143cb3416ab40706d086424e1339d185c4571ed46a234e2eff9c0717d5a5defc45d5356ac56109b152010cf4ad536d66ea2d5fdd9a4cc8197453

  • SSDEEP

    12288:6BT255OHTDPk/2BwKw7vsr2L4gO2E2RlAS+W3QapwLDuCNTkR:m2XOPkOGBg2bt1r6a1qLDNG

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2