Extracted

• • Target

    5e919371446f20bd5527336cc32b2e31065e361ed4bdecfa9f6541904bfd2e1dN.exe

  • Size

    972KB

  • MD5

    af600b457bbaccdb996b659fbd625fb0

  • SHA1

    3323eec115392ab4d9aeb2a850bdf9751b57ab94

  • SHA256

    5e919371446f20bd5527336cc32b2e31065e361ed4bdecfa9f6541904bfd2e1d

  • SHA512

    9b0caf1dabc42a49cbccab44bb4bfdf640c24e81b3bdfa186271495281d8c0ab40ac62e493b6ad39b8a388745033284d2b1079c80390a895dd5ff6ec671a6b96

  • SSDEEP

    24576:1AHnh+eWsN3skA4RV1Hom2KXFmIawe5h+ZZ5:kh+ZkldoPK1XaweE

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealercollection

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2