Extracted

• • Target
    New-Order-6-27-2022.exe
  • Size 20KB
  • SHA256 cdde2ec6c5fce8c0833d4721eaec2b5bab4a2b9ab326fcb28ae26d8ea0355a03
  • MD5 8d4696f0b9a51a6fdae6473a5f61e18e
  • SHA1 e8fd7517a43921d7bd3e02ea608044403485d832
  • SHA512 6f0c2f60ee6733ddc99dce750b6bdd78f392866447ade634d259654adef0aa2d0cc25de49c56fc59a88dd7d75099eabfce7a961b5539d86c17ece36edd369e8f
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2