Extracted

• • Target

    SecuriteInfo.com.Win32.MalwareX-gen.12551.26135.exe

  • Size

    908KB

  • MD5

    ca056a3aebdf8862e08c794f6f0a6f61

  • SHA1

    94163a06efc4784bbb04f1fdcf6b0321de3aff0a

  • SHA256

    1952bd4cf85d07d155fee0fd9f75b5c5e52af32c20994eb3b248fbd03ffe9fcf

  • SHA512

    f244400bc7aff7a6b9a650abc2f0e1d5d9f8232479447cfedd788c6f6605c78a5406241f90e72ac309a65c0944e61a8cd3d00741aab9b8651f5cb1afd814565a

  • SSDEEP

    12288:frT5UqCUfsgddZWQbQRqdPCYjkYUaqhqpDoIDpZLFUOvGUTSsFmeCiK2+9Hrs:f2ZwhtxTphtBSsFmnizO

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2