Extracted

• • Target

    2b8887e80909f776f73b07b6870c4f3f3be8697560e693a4786707d76aae4c01.exe

  • Size

    540KB

  • MD5

    c4407cbd68725778ecd99dc7638be000

  • SHA1

    0a232725a5857010de9eb61837fe6bbb3a6e151f

  • SHA256

    2b8887e80909f776f73b07b6870c4f3f3be8697560e693a4786707d76aae4c01

  • SHA512

    4ba0d5c953ce0ee4c984f36360c60fa4212d77633ec24b8bbff91ead5dbbd853272c9c6b4700e0db6865bc6678bd356c039a7623d134ff44068e107b3ad80376

  • SSDEEP

    12288:YiU+RfWk1Sm5bpviLs+fMKqirYo4A4OPoTo84RPlA24:Yi3fWxIbZiLsSPWotf

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2