Extracted

• • Target
    SecuriteInfo.com.MSIL.Kryptik.EOY.tr.29539.exe
  • Size 992KB
  • SHA256 bc7a7312a0b437df65d203117337461ac6fb0db097fe24f9e9acdb4c42480c6c
  • MD5 c555300e75e5379ba862491281f43e40
  • SHA1 4e1311d3f8e29f1da17cad9b8ef3deffe85377ca
  • SHA512 a5b301f0b320de79090bce990a0fd6a1259933fc684c05ba638e992142ff1eeabb9c5674f4bf886456eeb96990107255902a922ac71d3ccb4858a9bf091f44be
  • SSDEEP 12288:IqWjsZ5uE9uLPQRXEgf3rn8MRC6RbgPwpmzoRtbvRT7slylSx1rplBtnWgTYSpoq:I/W5HukhEgf3oMZtmzo3bvaz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2