Extracted

• • Target

    z94mxxxx.exe

  • Size

    943KB

  • MD5

    a73a636f607f3ed8676dce918933ee4b

  • SHA1

    21f02927a5c18b481a50bc9283b18952eebbdae3

  • SHA256

    38bc81b03cadb8769accfb9f84adc4638d2173153cbab047ec4d6cc7d27b3ebf

  • SHA512

    290b64f5ebf64890ca429bf47582a9c4408f9506bd22d65163ab8be5fcd917da83deb77313a4665d882b4d3eb5413a06f120824366e8877e7d1779d4b70e7ed1

  • SSDEEP

    24576:Su6J33O0c+JY5UZ+XC0kGso6Fa4gguyUbWY:Uu0c++OCvkGs9Fa4gByfY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Downloads MZ/PE file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2