Extracted

• • Target

    611A15D01208AD0010452147C4E153B89299E83450329FD2918AE88838FA6DF5

  • Size

    997KB

  • MD5

    ba6582876c5e9697840b20325ff120d0

  • SHA1

    f5a9ce06138224b27b9eb13bc258859acb177b99

  • SHA256

    611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5

  • SHA512

    fcafcb8c95414a41f5b3f0e7c80cd326e3ef84147af1adf7965a3f3fa236163e802c85508e0afcbf103777f7a9d3309d29928d8adc3ac5ca43e5bca39d81c59b

  • SSDEEP

    12288:ALkcoxg7v3qnC11ErwIhh0F4qwUgUny5QYEAmD4oESIFTYrgxtATG/PnaFLIont4:WfmMv6Ckr7Mny5QYjBcrbG/PFZUcW6L

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2