Extracted

Extracted

• • Target

    e65c722b00600584d7d4b3d076677fe3.rtf

  • Size

    13KB

  • MD5

    e65c722b00600584d7d4b3d076677fe3

  • SHA1

    852f00f649d43f8df47d730a57ec07db9ce29a4d

  • SHA256

    093aed8321e0c99537fde1bd8c9cd7e2bfef3fdcde9ddd5122f4d63665a9e602

  • SHA512

    8fc290a555916e6da21b8611f15a31d47c7db5146d0fad302cb0cd520f8391b4be13cc3e60cda94b0810a679d34725be04386230b5f78723393df6d65371d0a4

  • SSDEEP

    384:/TzQ7OauCOpdDuH+dmq3cP/HbjHcoKM3fyG6ZS9v:rz0OrCOpg+Mq3c3HtKVZS9v

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2