Extracted

• • Target

    Urgent Purchase Order.exe

  • Size

    1.0MB

  • MD5

    dafa52752458a225e50c37fe83869ee8

  • SHA1

    ff4ee0eee3d88d484b7eb544071c2b782a76c1fd

  • SHA256

    78c7a8275481c0695385f98d7826643a2132be000bdac4bb03c396c9f21c9833

  • SHA512

    2bb1322a7a237d9f78c7893a09de08977ded4596946fd0e1c0c0069aba93072563ab90b732e4274090aa4b36eb42bc56c26ea1c41198382c761b8563b305957c

  • SSDEEP

    12288:FhmXpjqj6jRPLjRPqjBjjyjBjBjBjBjLj8QJkPv+wYLaStPgt1senlKdBrVa5Th:bmo2wYLltPgtdlArVa5

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2