Extracted

Extracted

• • Target

    swift copy.exe

  • Size

    159KB

  • MD5

    a05dab3d9ba8ee173ad40f31f0fa340a

  • SHA1

    4c5edd5d59c7a3b79b148e3e2b91271f7364e9ac

  • SHA256

    5020d7b12b16dc94b7850fd3e25189e2a5181657456c3322bc2168017f0d067d

  • SHA512

    2135a9525edb31514a624efb62d1aeb8c4c0359caabe6e6b1eee7754ed92e6491e633861308dde58ed4961e1e5e0e3fc8068d00e0062a11f853c1f2f6d396c92

  • SSDEEP

    768:dukr+M0fV7RW1JbUGmp7NxryR27zAFEzD/xworhq:duke7RAJu7vryR2XSWwOhq

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2