Extracted

• • Target

    6e30a87063c1dd505b586dc369b90813be9abbfea621d753d88a2169ecd4310a

  • Size

    461KB

  • MD5

    d5299df031356e13dd0ac554dd35c324

  • SHA1

    e28d098f0254834120baed3d216151de4345ba10

  • SHA256

    6e30a87063c1dd505b586dc369b90813be9abbfea621d753d88a2169ecd4310a

  • SHA512

    098565a9ed509f4728a6b425eccb0926420bbbca4b119b645dcb65f56598ba68df3219ae04208e556d23111731698649d9dad6879b8788d2871e7274b1c17a39

  • SSDEEP

    6144:WGxhLzI5Pv0C1VG51XsFtxF+onRfO3txTA+PXwQ08Rbs79RpzcALhz:/sJXV0XsXxFBRfIAuAQ08cXpFLF

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2