Extracted

• • Target

    170c0fb730a8b383cb57487ae7614cfac311fb00c9d4577c66b0e9f0b6a29461.xls

  • Size

    1.2MB

  • MD5

    1bd3b6f065abfaa81547f1e18c0817cb

  • SHA1

    022eab00723f19fbe4ebad153e4d4455d3236a49

  • SHA256

    170c0fb730a8b383cb57487ae7614cfac311fb00c9d4577c66b0e9f0b6a29461

  • SHA512

    74c704262b4a1da9429be321b66ac7bb42334c0a52e56d9d3c06ce7236f5addd0906731fe923c6da6847535f7450fb31ba3366d29ab654de8172d5c91f7bee16

  • SSDEEP

    24576:8LKMBotHlxQWQmmav30xlBeYtHlxyWQmmav30xT6YEIzz68zy2W3Vs6Qz:8LKMc7lQmmQ30foG73QmmQ30Z6izy2W0

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2