Extracted

• • Target

    3d7654867efbc44661a3a5889d8f91fc402917587e58f9fc7a5c8c636b32b1a6.exe

  • Size

    949KB

  • MD5

    15029aa00dc1beac4707a80ea501048e

  • SHA1

    a17ebbb34e19533cd16daec646b0b8d3ed294c8d

  • SHA256

    3d7654867efbc44661a3a5889d8f91fc402917587e58f9fc7a5c8c636b32b1a6

  • SHA512

    49e9e8a27edb741ae5060813e26da1c48d75820346edfca2affaf79560e87be7f2b0d07d8dbaa13a88523bbfe251c20366d51a76d31d944cedd70738cd469ef0

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXFmIa5zCFBZex1JF5:2h+ZkldoPK1Xa5zCXcx1N

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2