Extracted

• • Target

    2a295d2593b44e3429bb9d86b61f28d36578c6840d19cd5641fbb59cfae66580.xls

  • Size

    1.1MB

  • MD5

    3963fc63e7f60f12b70794ab87ce54cd

  • SHA1

    299bc38a75e6051fc7bb7a6880b4cd1f17792a6d

  • SHA256

    2a295d2593b44e3429bb9d86b61f28d36578c6840d19cd5641fbb59cfae66580

  • SHA512

    2f386d93273bc806faaba4acf1453cb5d3a55f88e2d08527fc3e41c8fa20b7ebe7089cf5b8f3642ded7fce453afbaa9b7e89086ca20b012725305b8f5c9ac0c2

  • SSDEEP

    24576:SLKWWQmmav30xB+MXUu9/20+MXUu9L3bVn+MXUu903bVKrFWwyvtu01nwR:SLKLQmmQ30r+MXV9t+MXV9L3bVn+MXVZ

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2