Extracted

• • Target

    fddda3fca32418809de1c3b11f02df63878154d67c89054938a413f6d8bd667a.exe

  • Size

    807KB

  • MD5

    e9002e32b4e6094a3ef6550fd5351141

  • SHA1

    3359aa914cf67c5638de17746adaed1a1b36f246

  • SHA256

    fddda3fca32418809de1c3b11f02df63878154d67c89054938a413f6d8bd667a

  • SHA512

    1974654313429951a2255134dbcf3673a0f681a2b42c8fd85cef3695fba1a9f99b9fce4a107deea347bd2ba76ee90682d1b5665f14d8512196525cd147ee5794

  • SSDEEP

    24576:5MaSSKy2/SPNc3cMezC30i3ThYImbY/G:5RQJ3NCg0hxbY/

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2