Extracted

Extracted

• • Target
    Purchase Order-6630T.exe
  • Size 1.3MB
  • SHA256 57ded1368d1a4e13a6220b144f2b78cc91e915fccd66a9193bc2d9fe8d758432
  • MD5 4d7a01b055c96307d5ea406cd2adf368
  • SHA1 5de0541482709b987427ae92eaf46a9add607388
  • SHA512 20c600c8c2fc0f79c772de2b8dddfd9784ac9dfbb31c5bebff5f145fe445da9afa76777b0c9183dd79173798f7036ed9de0c0f56e694c6bd59e4007cfc14c79d
  • SSDEEP 12288:MnjoGOlk4/cnWZQzjFeM6DJOjB9sTTHyLTHNuaz+K9WVReHsXCwPCglEv:t1cnYQb6VOX+yEasv4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerwshratcollectionkeyloggerpersistencespywarestealertrojan

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2