Extracted

• • Target

    Purchase Order no. P212576.exe

  • Size

    850KB

  • MD5

    1311f07dc42fd9b1a7d078302a6fa19d

  • SHA1

    76279eab3809d9f7cf3c65ee6c3d349452905de8

  • SHA256

    b6abfeb2f4b5b9b41a34dd97806c12c49acc96e6f08115a7a7f9a5dd0a1db7ba

  • SHA512

    f82ea7db97b5a76824c8451b0d1cf50604891f37fce4e115cc30a760e33491a1de52ae167c1d2b516db2c43ced483a5b74067fb0545c1e233f08532a06bb7290

  • SSDEEP

    12288:PR8J2uT7cs+OJG4XfZaALFruvQIUfDj5E+gCUKCRWOxs:5lAQsbJG4XfIALFy4IC53CRF

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2