Extracted

• • Target

    d9f1e70cd9264c96526b79da353f0d2650c4019bc7e38bc42fc8d2ff88ffb807.exe

  • Size

    1012KB

  • MD5

    c24d00f74e24d7717a75692e6542e8d4

  • SHA1

    7856f14360a45eee5d08e53b7aaacffc7b85fcda

  • SHA256

    d9f1e70cd9264c96526b79da353f0d2650c4019bc7e38bc42fc8d2ff88ffb807

  • SHA512

    ea6b4fd8c7688bf0aacc8631ce8853234211d8d54ed1930ea4b4af7996901283630c6b16f17dcbf662c3dd4950f6109558f2340b05399f7fdd3ffc8cb0f666db

  • SSDEEP

    24576:Ju6J33O0c+JY5UZ+XC0kGso6Faj+CpmmITCDWWY:ru0c++OCvkGs9Faj9QQY

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2