Extracted

• • Target

    FA031225.exe

  • Size

    975KB

  • MD5

    8662ea1b48530f3a33f452f9425b3da8

  • SHA1

    95686f637d76f66ebc45343a3513e7714058c737

  • SHA256

    0f7a6cf0d9068cc6ade0e209574e007435e63f67983f05548b07751f103ef322

  • SHA512

    149cc3ed3ea5beae5f2dd3acf3afdd18be3eec97ed6452d9d93a6fdd65fba54d536d7ff394c35c4431ccfbd981af4424897b685b4e806b1edba752f38560d193

  • SSDEEP

    24576:ru6J33O0c+JY5UZ+XC0kGso6FaQ8FHDCWY:Fu0c++OCvkGs9FaQ+FY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2