Extracted

• • Target

    PO#7889296.exe

  • Size

    978KB

  • MD5

    1312de280df9f1a993e4c3d93764010b

  • SHA1

    8021cc971121660193bf049ad4e20db1421b73f2

  • SHA256

    f406a0fd055028ed41cfbc96b9bffb575e14272b26cb5091c7a16f35d15c821b

  • SHA512

    3e3830e22b1d34beef07557ce859bbeda607e12a5c334749f12428f6a894e4f3a124b6a63b720c72baa5bb21f486b937657fed6f5e2d0d59e5922f7dbc279871

  • SSDEEP

    24576:8u6J33O0c+JY5UZ+XC0kGso6FaVMn6ULbyZvNWY:mu0c++OCvkGs9FaVMnLbyZAY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2