Extracted

Extracted

• • Target

    Purchase Order.exe

  • Size

    517KB

  • MD5

    b9f9c9cac777dca7a78819914da1ba15

  • SHA1

    2369adcf893a14e6b8351edeeb2b6b63147fd157

  • SHA256

    32aeea1990475960922b9a0bbda5a7edc864a3c70e4b8c5e84b16e269ea6fc7c

  • SHA512

    987ce8faf0a50e3ee2e68a5f8412c63c6ff02209f696abf9ebc3e130b4f3916ec8f58e1c3655d6fdc50675d1eab2909089f021885ab440bba6d05ea7f609d7a4

  • SSDEEP

    12288:GWkE8HrebvPyMjBeIlWeR17RiQ2BPHzrl5UH:GZqzPyKBZWeR1v2BPHduH

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2