Extracted

• • Target

    MT_80362_72605XLS.exe

  • Size

    208KB

  • MD5

    f362e538a7ba343bc0b263549c105623

  • SHA1

    b70b3aae17c704cb571a9e03c27651c792b18f3b

  • SHA256

    cc4b5d5653d7dafb9cda51793a15ee5d987b82d3e62e97b3915e5032e7ae4f8e

  • SHA512

    cfc6c87e38dceb19803c921a115f10196807f87a3e040aadc1aae402c577584110fa60eb903a88bc3eedc2b17308a0043a477011061c7eb8d10ef324d3c9210a

  • SSDEEP

    3072:5bQw54d0TZ0tShFwUPnS21mQbnc+BR0pKREX/WONBuwrhmc7U1iIyxpIhNXOXca3:mpdUZ0tu6uwrhmAZcrFsnLAg

  Score

  10^/10

  snakekeyloggerkeyloggerpersistencestealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2