Extracted

Extracted

• • Target

    104.168.46.126_-_o_-_b08.exe___cbcffdbddd074c247071caed0e162729.dat

  • Size

    17KB

  • MD5

    cbcffdbddd074c247071caed0e162729

  • SHA1

    eec65a6aa6eaa1fa44b1832d405651e6dc87fe57

  • SHA256

    2ad849391b902e19d516b7cd3eb0c1977eba5f39baf5f1e687ec09613866b721

  • SHA512

    9adf006b456245c5332b0fb69d8f76b2c46a53b6658d69e179a8ed8cafda61b86e1000e7744eefc7568f9aea0e27053b57449be947846d4a9cf9f4b8a3fc8d92

  • SSDEEP

    384:UoZHmnT8N7wgseoLf6VYgQE8AWilNekNek+vD7:UGG0cffgLo

  Score

  10^/10

  purecrypterdownloaderloadersnakekeyloggercollectionkeyloggerstealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2