Extracted

• • Target

    PAYMENT CONFIRMATION.exe

  • Size

    1.0MB

  • MD5

    675d183e4463f14c2bd8ec4b269ae2fb

  • SHA1

    0a192d6a24bbd47e9fc69bd8c5e7679404faf2d4

  • SHA256

    15d4d43a625f4ac0d1e6ac4a60a1e43285e249b5c2dfb7c652fff6f491af1364

  • SHA512

    06c0fecd55f35a49cec6bbf4dc5b5559db6c02c594676e79c84a78b793ee49b814ceb9cfe5a9de0dddc8b8318d924ad2c137086f6de42b12c8012af341154c89

  • SSDEEP

    24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8a56Rkp0pe:RTvC/MTQYxsWR7a5Ckp0p

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3