Extracted

• • Target

    20022025_1515_x.exe

  • Size

    928KB

  • MD5

    d6cad9ae104176d1257493d34c72eefa

  • SHA1

    abecc90d4063be07ac33dc8468c2a79896d66704

  • SHA256

    8c101fa83a5f6c766e1fa501eed50f0db93b407bf4ac8164f41f603a4838bb4f

  • SHA512

    63c0b246a558487963f9149e9d3020eca398c69491b73be305f0cbe499c281610e79ed2547488e763361b43aa183a4e297a8c044e2f5be932cc7bf883c5fdf5d

  • SSDEEP

    12288:6utiz0ztRkWC5ZdVRpMp10gyA5pF2n3ekR:xtiz8DVa7Rt+FQ

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2