Extracted

• • Target

    SK09876.exe

  • Size

    616KB

  • MD5

    eeec5bbe187667b25e6b6b8e68d4dcce

  • SHA1

    12150c63ad276e94e3270ce3169c1afce22534f2

  • SHA256

    14e06136df7cb1d702865305be8e50343153003f1faf2fd55d85480abc14354d

  • SHA512

    9f65522b95e38c15a6cfb545a0b617b6fc123ae4800ad57c2e65e92eeaf3a3ef1c1df339d4716f0a41310f0600c3c1b81bf30f101550aabb21ff1eca4e133454

  • SSDEEP

    12288:v6Wq4aaE6KwyF5L0Y2D1PqLx8HgCKxYWFJ/MIGcEDhL53TleNU9AFbmdyh:tthEVaPqLx8HgCKd7mlDhNUNUKJjh

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealerupx

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2