Extracted

• • Target

    ab8b90638c590345b423c272f13e84c888ec925224c29b4319555cc14621edb8.exe

  • Size

    1.1MB

  • MD5

    b95ddd54b4aab9e71cf7820bb495d196

  • SHA1

    700aeb210eb831122e06e280d150656106800753

  • SHA256

    ab8b90638c590345b423c272f13e84c888ec925224c29b4319555cc14621edb8

  • SHA512

    a04197b79fa2f65025c0f750d7201134965fc82b6c92a1bb79079b820f7fe17119f731ad1547708b4f4e4599b600e97f2066ce2afa528cb03b9bd90be3f10d93

  • SSDEEP

    24576:hAHnh+eWsN3skA4RV1Hom2KXFmIaeuZK7CiU+WFwut295:4h+ZkldoPK1XaeuziUHGu6

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2