Extracted

• • Target

    9ecf7983e1b3d14424cdfca12558847bed0d335011b3e834f4fee96279bc502b.exe

  • Size

    972KB

  • MD5

    8c8cdce870723016e50fdc06561dc2ec

  • SHA1

    30262ba9167ec559c30bc7fd0119523761473fd2

  • SHA256

    9ecf7983e1b3d14424cdfca12558847bed0d335011b3e834f4fee96279bc502b

  • SHA512

    76c8e1046a268909ed2a00f2e0dd0f90ba9c6612e722b31c26427f4e90accf6895d8593534962c9649f7c2c3993d2236fcff0b3488c722ffd5e2c3719d8d15d5

  • SSDEEP

    24576:1AHnh+eWsN3skA4RV1Hom2KXFmIawe5h+ZZ5a:kh+ZkldoPK1XaweEa

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Downloads MZ/PE file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2