Extracted

Extracted

• • Target
    Yoelcvrbdj.exe
  • Size 19KB
  • SHA256 17e813ed934ac345e4b9b9384aaff9e5b7a20b4efc8f75ef784f06bde2420b2d
  • MD5 e0848154f754c0cb4d9fce30e73d258c
  • SHA1 d854344383ac3fb8a6c81653df97dfb6ba47d7e0
  • SHA512 4a9ea4ac5bf64494f0afdfe636397edfdb425329647aef7e8cc757e1794b350d90d7a10e839f52687364e605fcc7095d91890aa1d99cd1fe3820ac9e5946581e
  • SSDEEP 384:Fzf4L7L/YLpr71JdWUyLJiCI5HNPNZJ9afejI:G//M3iJ/Ij8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2