Extracted

• • Target

    V13145 Order PO-224005.exe

  • Size

    848KB

  • MD5

    134f8689013cea212014b283cc045320

  • SHA1

    c926356e92fc074acd8232f8025d5b1df65abe00

  • SHA256

    60bc83d86c495e11d556ff933414008ed8228d9c2060fc18e230dea899e46edf

  • SHA512

    2cee3220ca629b2d69dd0f1affcecf859a171dafa50d1710a61e80e9b395332a8907039c3951690d95e0e1742c0e7733eb2a33846cf59dfabaf6ce5c64c210bf

  • SSDEEP

    12288:byDc9F3nC0Py3gAhDRNCeLterrzVSsjT/RwAkzIV9eoIQ0PPAQmL7RtfiHXtrabJ:bCNC8YUsnRbkDo0dmJ1i92Dx

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2