Extracted

• • Target

    New Po No AB 0571123.exe

  • Size

    577KB

  • MD5

    a4fa700148049299a5800d542d2691d2

  • SHA1

    e1d5d567763ea8586b8d318de20d545ad97d98f6

  • SHA256

    f2fd94a4807a949f3a53c1c0bf922d724d3fa0aa9e5a9dd834edbc9187597b84

  • SHA512

    faae5801f98ae1fa93a3695be94eef69a2740bd40955e46dbc395588527fb17bc0ce773dcdb7adb8d5fc0cb01ab7eda7c746f64d16b9041da4e80c30011b5a9b

  • SSDEEP

    12288:fED71TllYmtlNXItdKTtQ9maIMKlcViQmbCpk:fEDhTllLlRRJQ9LXq

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2