Extracted

• • Target

    da2fcae0d75bf3aba109c8d4010ae5db5add095496db883c257deaf78e9bfd0e.exe

  • Size

    580KB

  • MD5

    68ea88ab97c52f5c4ce75ce445f9aead

  • SHA1

    02735913dab48e3702ac3b3fd0072ae2e7cb5c63

  • SHA256

    da2fcae0d75bf3aba109c8d4010ae5db5add095496db883c257deaf78e9bfd0e

  • SHA512

    f809c2b1a6cc926c8f45d1f43a60a016f3818aefd5446ae538c025b0cfb2f3125da9cb34aec3a1be2c15c906f8a1d12e7ee0023c3ce69b9a6047a87be07dee5d

  • SSDEEP

    12288:+Dtt6a4K/a/G4rgdwKVOT2dB2mPTVJSyPzu5usx+XtYYI:+BAaBaG4HKr76yPzux

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2