Extracted

• • Target
    shipping doc.exe
  • Size 586KB
  • SHA256 2bee3abe1bd7bdffe2f095992123f9fe33374ebd05fe5f8c8f625f2a18ef9052
  • MD5 893cabbdf25fa5707d24193d5a9e68d1
  • SHA1 02e9e91e0e94cc436bda5cadc1c7ba97b23b1e04
  • SHA512 edda852992847c38be84120b52b6b4e05e4e422982dd9949c7aa23ac1165c4fb8ad8d7d63ab80cae17bde82317aa983fbf132716fb3b523959b994a6d24b9621
  • SSDEEP 12288:PODphClGCxJAisF6gMuU+dpMKCJt35dxC:PRgAvJl5dxC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2