Extracted

• • Target
    1a895996e3edf28787c2076049c1ec3ce137824bfbdff3dc6e5e020077762c85.exe
  • Size 625KB
  • SHA256 1a895996e3edf28787c2076049c1ec3ce137824bfbdff3dc6e5e020077762c85
  • MD5 2e843f8a327dfd930a59b0edec51e282
  • SHA1 7a24284935d0c35aad3fb1ac18224a9669a5f0ca
  • SHA512 dfb5edbfb857cb7e7d23a516d5f2b257b2a982347a47380a90e4f6a2fccffdb8d45bc3bc19a9457827c36ea6fbc5470b64e50fc47bf222b3ca966612b3d00def
  • SSDEEP 12288:d2iNfC5s8NClDKooEdk1eY5vtacltQFsPOEaqExgKG1rxHCakR:d1dC5sNKjESVJltQGGO21iC5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionsnakekeyloggerkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2