Extracted

Extracted

• • Target

    Ymplhchis.exe

  • Size

    9KB

  • MD5

    66b64cfac83171e194dda651b97aeef0

  • SHA1

    cc65aabb69e797a01c2c06886d523683fc756c19

  • SHA256

    fadc70c73f31f1cd2982bcf510846c09a9ddb209cce4e84d6237803fba50f58b

  • SHA512

    c162987ad139ea66152b3c31a13b8f67d8cf20fc0eac420dd6dea58eefd183ec94a8de6af30be53130f5f7cbc1aca5cb6ce665e362ce145e8eaec59be1cb5bd2

  • SSDEEP

    192:r7IRHVefS0loC4cge45pz/7H/hShLTG1sl/pv6:r7i1efFp4R95B/r/hShLy6hy

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2