Extracted

• • Target

    ff114595667cf12d185e3e147290d41d4f91b8c2a065812741e540e99c2f0db0.exe

  • Size

    976KB

  • MD5

    43743091973b08e4265bb937d78d0522

  • SHA1

    142851ffb4aa49a41edb2bfb83d8459138582b27

  • SHA256

    ff114595667cf12d185e3e147290d41d4f91b8c2a065812741e540e99c2f0db0

  • SHA512

    9745ba5fdf5bb77c8ce1350a8e18e4e6fce73d8084a3b1f1db26cbdbf8b63a6cabe16de80227f93496c4eb13bac6795b2daf9af696f5da3f63983bf3dfb8c275

  • SSDEEP

    24576:1u6J33O0c+JY5UZ+XC0kGso6FaPX+8n5QU2PvhfWY:Xu0c++OCvkGs9FaPTuTEY

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2