Extracted

• • Target

    FORM E CUSTOM CLEARANCE.xls

  • Size

    1.0MB

  • MD5

    5bf6a6355aa87c0b503ac9483bdda694

  • SHA1

    4b66e4a3ce22603d9e58893c33b023ffd1f96713

  • SHA256

    c749595e9a90a739657ba41098f9c3e50324f2199afbc8bedeeca02722645fcc

  • SHA512

    5fea39f477432dfb6c64201b218bf38e9a33ee7ac62f38f0f40b1d34902976cb5de1c7142c6049c51a481aee4bfa029ede63d201a899a01d3f94fa409b7fb6ff

  • SSDEEP

    24576:sr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXgmhr5XXXXXXXXXXXXUXXXXXXXSXXXXXM:

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2