Extracted

• • Target

    a6f6e18a65c1b0247944a3d52d26d7616290ef28c8aba5b48253d125887e83dc.exe

  • Size

    924KB

  • MD5

    39fe6aa3bfcf971e363ec7865079fa05

  • SHA1

    7f97b49491bcda0402a02d0a1946b0853c507d6e

  • SHA256

    a6f6e18a65c1b0247944a3d52d26d7616290ef28c8aba5b48253d125887e83dc

  • SHA512

    46f3ea719488dc5a847baafb2e581f45845dd0fb902d7bcf50f6d865d1730d14d8d55b481be5f3be0be879766486e500ef5813d86bde7dc230d0dab90d2db40b

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLwlVZGnxitFM+pJiADs/3FzmaE:ffmMv6Ckr7Mny5QLbnHYius1mL

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2