Extracted

• • Target

    e-dekont.exe

  • Size

    964KB

  • MD5

    c8d6b11dc374c199bf9441652c082536

  • SHA1

    e34147d7c461238e5aaf8dc578cb31e2e5c48961

  • SHA256

    2874c46654f4a815de2330f58b000a4e2300937f085ffdf32c2245ee92037ddd

  • SHA512

    ebfbebd2fcfc2dc1e5f150162830c7e6327c26d3af674402f772cfea117dcd9b25a329a2b6321eb15c3c0f8b3602655bc58a8adc169533abe7c827a5ceb43b65

  • SSDEEP

    24576:uu6J33O0c+JY5UZ+XC0kGso6FaNDF6lqh6BTbWY:gu0c++OCvkGs9FaNDEa6BeY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2