Extracted

• • Target

    AWB 5331810761.exe

  • Size

    527KB

  • MD5

    610b212041eb748a9ea82dbff6741206

  • SHA1

    44c645dd3c50b7b71aa242d964572e2825fcc621

  • SHA256

    e47b7ff50e6e7dd47087235ad782bdc84255e2642e80744d34ae027a2db13aec

  • SHA512

    a279210b42155560c7c0494a45db8de954ff5f52eed46c848b1b352e70b6f7302e8849feb4b5bc17e1b7a977e00fda3990f3d9ae7be1034b42085432816c5c5b

  • SSDEEP

    12288:J09E4ImicTbYVEGshXP5MBFg20nqDIVq0X0of/Zcsb:5DmLRGshXP9/80X0op

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2