Extracted

• • Target

    3d58d32a658515f1933ee63c92a7b9a06d2567fb310264e74adf19f55366d61d.exe

  • Size

    1.3MB

  • MD5

    87f99a784aef78e61dd44cb46ab204f4

  • SHA1

    10fa8c6ac185186ad405b24df82b880bcd877e68

  • SHA256

    3d58d32a658515f1933ee63c92a7b9a06d2567fb310264e74adf19f55366d61d

  • SHA512

    d0cb92d83ca739d96587430638c33def6c5acbb995e11bd2f823d77cf038bac826ebc8fcf093e4e55e80fda4d92e83fbbbb6f88e909c5ec401d94bd28fe7820e

  • SSDEEP

    12288:R7gcxkKaezJfzxfdrUska0P85kuZrB0OXYQbKixLnB3cjSektnKMkpmXOE9iEjHE:RSexfdrU/d8mQ1BgSkqrzj3WXWqHZGU

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2