Extracted

• • Target

    63e970412f2465ea620ac5a86a78584366a531b7c74f1755e8b3bab4a653c65b.exe

  • Size

    880KB

  • MD5

    d2f01bfba149898d86d9f9b1344c871c

  • SHA1

    7002ec5c910a1883fd5c56aecf17c8182a175acb

  • SHA256

    63e970412f2465ea620ac5a86a78584366a531b7c74f1755e8b3bab4a653c65b

  • SHA512

    9607a66aa1f572504fa68ca6464cde5763c13e72ff66e1cb94bc8f1e8d4e6765390371664b18cfadc6954b21c711ac9f05c95dd6c38945d6f9ed2ce653237254

  • SSDEEP

    12288:bEfVhpe/ijKZVn6fYpoW0eJRWmoaoTxAKScque4RJjBQ+60NAIJxT6t4kR:bEfVyijKZV6g+VeJRLVoTx4z/4RY6gv

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2