Extracted

• • Target

    bdb382389eefc500306dbec15a700729461619bfe143a4f3b3e3d590e4f575c7.exe

  • Size

    969KB

  • MD5

    e3b3d568e602fae0ca682a90ce0871b5

  • SHA1

    889ee5a21ef1c377855c254975fe62b950a78591

  • SHA256

    bdb382389eefc500306dbec15a700729461619bfe143a4f3b3e3d590e4f575c7

  • SHA512

    ca6777de939371bf517d6b1bc35b74af1ce6294d5b4cdd576ad68aa98c5fd107458ce246208d12d9e0597e64384c226e3f086e205c52fa73ba167dcbcf3bfc9f

  • SSDEEP

    24576:8u6J33O0c+JY5UZ+XC0kGso6Fagc6R4dVpEWY:mu0c++OCvkGs9Fag5R4lY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2