Extracted

• • Target
    ISO_003820_03152IMG.exe
  • Size 541KB
  • SHA256 609924bb2e3350f494553b8a7e91916766dae319d2b17550c8d97b403fc00794
  • MD5 0360f849acb6816bd3e2ddcf51ef6f95
  • SHA1 2973f40f6146160fadc6e9be2872ec90fad20e64
  • SHA512 c9c48f923e7b4d10673a61afb536ac8f2a430401b7ffa83ead60e0c6006f2be36bcf7c14915bdb5e60f449f3e6c51fa80f7493e778f6b37c41a7ce187abe5163
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2