Extracted

• • Target
    800b2d20d87be38e59ed0836a71820ff042a39c3087cfcaa26bd20d1e0db78d4.exe
  • Size 571KB
  • SHA256 800b2d20d87be38e59ed0836a71820ff042a39c3087cfcaa26bd20d1e0db78d4
  • MD5 10a1c5245f2f0d8eeea1e553003912c4
  • SHA1 a680d711677b156f4377a985b1f0df9b06472c20
  • SHA512 5bb3409fc30c852f6046bff176cd44dacea89db754ae8564ceffd603de3ca488ecdafe9cd531988b58532194cfbf2ddf0e4eaa435224a7abedf5b403eb5beca6
  • SSDEEP 12288:ojbsKZaywhhFuKbMlOQoqMhrSwVRNf/F4lx5jQT:ojbsKwyEhFu/VchVfN3aG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2