Extracted

• • Target

    PO#76215720223.exe

  • Size

    1.1MB

  • MD5

    68e0165684e6817fa57a9291a9430b63

  • SHA1

    f21bf5d7a69bdf313ba56e330319077a9909dd5a

  • SHA256

    d27239b28cfcbf7da1382d13b9ca2f8967241b0b8493db3df87ae8ebcad71045

  • SHA512

    1e0627e4412f4e6d818eb6ceb8bd5b1a214539a6dfbb783ad050af704a9ee612a6434a9a2e2450699e7e99bda3f680a133c7be0a3df30d66e5e90ebf69f5dae4

  • SSDEEP

    24576:TAHnh+eWsN3skA4RV1Hom2KXMmHa7wMexG5:eh+ZkldoPK8Ya7HeK

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollection

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2