Extracted

• • Target

    0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe

  • Size

    1004KB

  • MD5

    286d68b773e946b301bd7134769a58e6

  • SHA1

    82004957c97f892b7ae6025c333bc6da0b17ca1a

  • SHA256

    0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894

  • SHA512

    a4a4d4ba2abb064106bacbe92da3006be0176aec44282410fc56cdf32fea7611863b2b477de7799f7a8d5588305d66626cfcc13d46ae39e1c32d502e127313ae

  • SSDEEP

    24576:du6J33O0c+JY5UZ+XC0kGso6FaONm/SWCEr41WY:vu0c++OCvkGs9FaONBWJrJY

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2