Extracted

• • Target

    AWB 5331810761 DOCS.exe

  • Size

    558KB

  • MD5

    2cd255beb70377f0e7f5263c64e3a95e

  • SHA1

    58551fe38c833a84a8e6c8cf944b99e07d4b1d87

  • SHA256

    96ea4265a04a7c823bc0a2d69bd32f60e2444560514e432300f54188170de56c

  • SHA512

    391ce67cb3fd408cb3d9b48341532b8b059b221dc6f8226d5cebdfe7988d2d585c3acfa3723e08512df76e9ac6bf398b4f9a89cd1cd054960a5f7414fe0b1cc3

  • SSDEEP

    12288:GKdiOsEnxLUC7+B2WcuBwYhKSZHw9zoSnnkgsMwad:GKdiiLcB2x0ZHw9zfuad

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2