Extracted

Extracted

• • Target

    New Order _letter.exe

  • Size

    72KB

  • MD5

    f50c01b28f63ea3a2f9eda5d3f62cafc

  • SHA1

    15194fbd3471810bf689da9efeb57efdd4e4f21b

  • SHA256

    0e7012a66e5d3c6ada99f6dcf651fc8a29f31aa74083f76ee96992df0be54ffa

  • SHA512

    98bd8ce28d997815f135b0a73af05cd45d8bdde9d7a018311d7082ee76c3adca78b62ed161fc187febed6037aa556309cfaf13b2a29b1bd65c4a759e8fd5a8f5

  • SSDEEP

    1536:Ua3eJtxKnsYsEMINcTa7FFrj3Pxx1Px90:Ua3ez4sKNykrjfxxpxi

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2