Extracted

• • Target

    da4a4370eb4e97775038824dfc8e9eb85e795ee6db9a182ab8965f25aa533630.exe

  • Size

    130KB

  • MD5

    4f94fd9f205bbf26710198a0e176b35f

  • SHA1

    7fcd8d18153a9b25e37cce7f15f968ef7d923dfc

  • SHA256

    da4a4370eb4e97775038824dfc8e9eb85e795ee6db9a182ab8965f25aa533630

  • SHA512

    dda1b8602bc339901b96de775de5d3576428f148cc08b0985eed5caf4b58997a1be7d9114ecc18e9e8487d5ad28b81c4b17810b0e40eb20f4ced1b6520e7098f

  • SSDEEP

    3072:lLIyRktx3CI9jVhNZ5KvRksb5h8m9ywvcGLgbY:DRyxSoKksbbmb

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2