Extracted

• • Target

    Sigmanly_12e1be7e89caa22df82c876fe2dd90ba

  • Size

    12KB

  • MD5

    12e1be7e89caa22df82c876fe2dd90ba

  • SHA1

    3b129bdd35aa241475f123aa72d374f3ccdd2009

  • SHA256

    ba3087cf0ca847cb8b06d7511425d903cd97de1b88cf6fbe32fae406a3f9f78b

  • SHA512

    be89fb6258ad9f9d0275566e8fcc0102d1e328cbafe8f452a42ebd413c7902ea1b11c97b1f9a366d3335e0c9ce1878d546f4fe7d20c58e9a6f877a6b079d26e6

  • SSDEEP

    384:w0du5F6ggVCHVRHaPSqsDhVLEJ89M5niUtl:385kSVRHcSXDhVLEJ1iA

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1