Extracted

• • Target
    Attached Overdue.exe
  • Size 1.2MB
  • SHA256 962b66d01dbbe1dd3cd85dcbe030c318d2f685fe5a965133279f5afb3b6adb94
  • MD5 f406eec5a9130385e70b8f623eec2c9f
  • SHA1 b29d1694cc0a1b04f0b39c4f11488bc1778e106e
  • SHA512 1209d810ebd034f234de954ff681a9a2ed42d26a9c0997eb46664216e489dc6a5fa9364ca9357a659262b289eb1c88bba010e666d096888953321b18c89810c6
  • SSDEEP 24576:MG4mma4gR1UZQy61LqdOaGyXdzFmw5tSZ:CZC0xOundZl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2