Extracted

• • Target

    d0d28661ec38fa97bd723628c065471e1c58b6d3918fd988b43cdf0aee2815a3.exe

  • Size

    807KB

  • MD5

    22b0c4defec129bb6a33fc44f1499910

  • SHA1

    4f5d255970be2c547916a72d2db99ed5b02a89b7

  • SHA256

    d0d28661ec38fa97bd723628c065471e1c58b6d3918fd988b43cdf0aee2815a3

  • SHA512

    63ba4513e693638e2365d357e6757a7268134c2c0385644a6118cf79fb046e44517eee1f22853fc7d4c5875bac00d56c0ac6c8a01dca76c0cded2b7dc991da53

  • SSDEEP

    24576:5MaSSKy2/SPNc0PrH5yj15ALOF+gGQ5p/i:5RQ5s/gt

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2