Extracted

Extracted

• • Target

    Yoelcvrbdj.exe

  • Size

    19KB

  • MD5

    e0848154f754c0cb4d9fce30e73d258c

  • SHA1

    d854344383ac3fb8a6c81653df97dfb6ba47d7e0

  • SHA256

    17e813ed934ac345e4b9b9384aaff9e5b7a20b4efc8f75ef784f06bde2420b2d

  • SHA512

    4a9ea4ac5bf64494f0afdfe636397edfdb425329647aef7e8cc757e1794b350d90d7a10e839f52687364e605fcc7095d91890aa1d99cd1fe3820ac9e5946581e

  • SSDEEP

    384:Fzf4L7L/YLpr71JdWUyLJiCI5HNPNZJ9afejI:G//M3iJ/Ij8

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2