Extracted

• • Target

    d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe

  • Size

    2.3MB

  • MD5

    a031da4bae8bd9cf87c071c94f67d21b

  • SHA1

    29146f6e8d3107eb8cc5b362b15d8e57c3f815fb

  • SHA256

    d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f

  • SHA512

    bd84ac0d0d3a846b5eba97d7a440f79034bda7b381f836966561175e98aed3d87e194441da0a19836c6acb3ec8293970efecb46767f303fd12956a0db9fb0b42

  • SSDEEP

    49152:fu0c++OCvkGs9FacSc9fbFtWR1+0o8fyNq6UQruXZO1KgRudguKB+kyo3zJ57O1Y:GB3vkJ9Qc9jFs/QzNDogRudgLB/ySzry

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2