Extracted

• • Target

    Zasneipp.exe

  • Size

    7KB

  • MD5

    c035e1bc5f37c474441db456d903eea0

  • SHA1

    bc6992a6e31b6d67b6732c142ec47bebde49fee1

  • SHA256

    84e348e49442b996738cb0d3d4fcd275e3db781fe805045e139736d9eeeca695

  • SHA512

    845f22b8b4f6a75d96f63e5546c7f719de57d54b4f15a9789f4156e1156fb6fbe54d61aded8da54a1ef0e8e2d9e55192f18ee032d43d1f2c6c5fd675a3150373

  • SSDEEP

    96:iUBTdcgDszgY1KsXrXhRQYYB3Tt4BtEkdexegbFnU:iUBhUdRQYYFGzAkZ

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2