Extracted

• • Target

    HTWP098760233.exe

  • Size

    458KB

  • MD5

    e98405841a1287e07e371cc0058475ad

  • SHA1

    21a40b88b8b5fbae87836a32e94c32afc4898eb3

  • SHA256

    8f1be325faa69592642419a3ce86343a7b484853d0a1b27bd769f8435be85381

  • SHA512

    801a0cfb1c359c86a54616d6d4a314b18a875bb907c2056c4435e3e9e128dc215dc5a54e95e2676cd4924c15a568dcf596caad7e4b1b4a992ae9dab56da7d9ca

  • SSDEEP

    12288:v6Wq4aaE6KwyF5L0Y2D1PqLUb0z+ZHhHg4vzlN:tthEVaPqLUtNJdblN

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealerupx

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2