Extracted

• • Target

    e1732cba15f25659e29ac1967f934d05ca4705a5b7e0f79921d975d7576f6e7f.exe

  • Size

    969KB

  • MD5

    f8f0c06d50ce1b865a689f0a6ab52f20

  • SHA1

    9391593ac377b655a03f638a9a3aa25cc1b80aaa

  • SHA256

    e1732cba15f25659e29ac1967f934d05ca4705a5b7e0f79921d975d7576f6e7f

  • SHA512

    5d684eacc88f2f625ecf711e32e684ad7f1d03f28554035517d8d15c7cb45ea8f49a6d684e5405cf7d64cadfe01a105c798888a91f91099b4559b2f7a7a32a8d

  • SSDEEP

    24576:aAHnh+eWsN3skA4RV1Hom2KXFmIaQB6tpD5:th+ZkldoPK1XaQCD

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2