Extracted

• • Target

    INVOICE.exe

  • Size

    572KB

  • MD5

    1457e577596abbbe8fa4e98e2fece1da

  • SHA1

    7817268b3b29232cd8dc35ced850f60867f9e24d

  • SHA256

    bde75e5a73df3ef95e72fd79905f718427f70945166bbf8558f9e84b3605abaa

  • SHA512

    2b9b7f57b9be93d98c5b2d0444caffa81ce8161884328b4d38299017d3348d1b145b4ccc890d4238aff58f13b6410c749537c5bd76f7cfc1d4c594f2f47d0dc6

  • SSDEEP

    12288:7n2iNxQPYsPEiLHEm/YZYg8p+9bhr4zZsdU:b12YsciLHFYmM9bhRd

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2