Extracted

• • Target

    5331735ae84af50e1ccf339c9fd96475ab9b1e11a975abeb64206a265fa89245.exe

  • Size

    943KB

  • MD5

    c07188b71dcf7d05af7426446975c027

  • SHA1

    421e8bf98a7f36f37b77e46e2533dfe1bd84be1f

  • SHA256

    5331735ae84af50e1ccf339c9fd96475ab9b1e11a975abeb64206a265fa89245

  • SHA512

    38fb27751ae48ef1769cf701b2849a175b5695446ab2305002a996527cdbcbee43b600f0e2c1bd0e691453a051d19250cdd5c49e4ea602fabd8a6e83fda49e2b

  • SSDEEP

    24576:Yu6J33O0c+JY5UZ+XC0kGso6FausNkYlYVfWY:Su0c++OCvkGs9FauUN1Y

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2