Extracted

• • Target

    e4dc621e2aef5e6f4d3b3087572efb9816ce555894a039002fa5cebf053df8cd.exe

  • Size

    987KB

  • MD5

    58fd54106157d2c514d61a77d34df89b

  • SHA1

    b94c0be6a242ea5808bce1396d3e4bbedbc3a620

  • SHA256

    e4dc621e2aef5e6f4d3b3087572efb9816ce555894a039002fa5cebf053df8cd

  • SHA512

    b2afdec29ad746295a91d9bfcf2f5def55926e52e212cc8e09862e6c664213ce2b4c03a85b17fb71a4015e59ff6a8065386031b1d505d508abc0914b5285fb87

  • SSDEEP

    24576:pu6J33O0c+JY5UZ+XC0kGso6FajEJjuZ2QMWY:Lu0c++OCvkGs9FajEJKZtY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2