Extracted

• • Target

    PO 534243.exe

  • Size

    560KB

  • MD5

    bcc7c8a06cf4c1e386bc12606ebf000d

  • SHA1

    55b2aaf6543d97d94095e340f74faef46a5f4f1f

  • SHA256

    e61dc30af3bae04f163df687e66592073621fd84933988e36105405f38053c45

  • SHA512

    374c3756f5cdb28703c6b0700e5b4f6a79d97f164ea7a02d9a1e5a6af89c1377f78a628bebb7e447c6772ab6db469e697599981ecad8397b51a5e5ada95f2094

  • SSDEEP

    12288:FYaAfDuHOXRjIMsKZ6/NXbMxB/S98AC1bvB6kpYbIGscnbaLncanF4:FYagLhsLNrmB/SrC5vBkbfnGcuF

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2