Extracted

• • Target

    Order_PROFORMA150223_DOCUMENTACION.exe

  • Size

    420KB

  • MD5

    2e7d0cf4cec98345f5c0a37b41a4ec28

  • SHA1

    e93e2ffbce12cdfbc2da6fa985a2b4cf934ca756

  • SHA256

    0aca8e757450257b435be941b91b79bedc38d9b25be3a60b10a52aec61a158a8

  • SHA512

    0397f3a3d40b51eed45495f2a20537d620be0599e59b4716951c91736c349a95aa0c9c133f8ffa8098e858b7ff014be64dcc389c29841e9c40171b42e84d6185

  • SSDEEP

    12288:ioZqMpB0QfDg1a8+kDCyram5H0naXmpf0v:iosMOQfDg1a8+kDCm0nppf0v

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2