Extracted

• • Target

    d53a9888b375983c277dc4471f3f37e258cca57a1e242784c4130b928127c254.exe

  • Size

    542KB

  • MD5

    857fc5f1da7948839d47abe238392ea2

  • SHA1

    8cc415a58dae52f82befc0dafd947d519a4b1574

  • SHA256

    d53a9888b375983c277dc4471f3f37e258cca57a1e242784c4130b928127c254

  • SHA512

    7aa0f11c047f5c2401b048162f5596b656872fe9bc9a20b3b674855a8ea5c31c571f196614a9c0e246394b4ea45796a82d1cbcefbe13fbee4945abc348d01a9a

  • SSDEEP

    12288:YiU+RfWk1oPD4MAQXOHx7S+r0c4rOQe9HDv24RPlA24:Yi3fW3D4v3c+r0clRjvDf

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2