Extracted

• • Target

    Purchase Order No.KL0093 Athens Branch.exe

  • Size

    1.0MB

  • MD5

    49f36f87be737a71e153cdb06d32736a

  • SHA1

    a62012c8bc5f66f36228bc6b746381805f54412f

  • SHA256

    19365435590c1225513df7750eddec47c42680761a0fb946e10085d3aab90b3f

  • SHA512

    cb73a6505203b432864f2ce6155285d81b443889e96796bab65c2ff97b3c8508da26816b8217453ecfccc8c6e56794351a971656eb668ec0b6bd88fca5458a2f

  • SSDEEP

    12288:ipPXpPweBdKmPz88e4C1V4C+suCqbxEBPAsV7vPr/8dRvPxNd27BcPYNzHlZ:ip/p7/qJ1V4jlbWdP5vr8dZxNXP0HT

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2