Extracted

• • Target

    Mybxbutrghm.exe

  • Size

    36KB

  • MD5

    e3943355389d2af1de3dea068e7ca43e

  • SHA1

    da4c486cdc0f0329f2e2969d9df698b91599d88c

  • SHA256

    07f7c6e2ca27e05f3e3924f8b32cf92de6493ec4b7657beddc3243d7ae49cca5

  • SHA512

    6cfb9713e4227189cf6401143b2f107bf40ccae5e227cb2e460fa82007297c510eaff72e6b7b599d762672d9146587770c2aeebfba80eba488c9167d29d61e7e

  • SSDEEP

    768:RZOZ3fnxNzV5j1DLas3RqtGx+roLYP+k5:RZifXjj1DLasBC+k5

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2