Extracted

• • Target

    Docu_60207.exe

  • Size

    11KB

  • MD5

    b68a44b4682a233202be2f2a72a7c43b

  • SHA1

    5af0035b538748837e893ef42d23c5653c9b31ba

  • SHA256

    fdadb6cfb3d0c231776c54357452d56bf8ef73d0f0f9c9aeee43c90c639703a3

  • SHA512

    027799791ec263ba8e7c22b70633f97a89eb479ad19e881377a2407c1488a04ce61ded8fc569f52fdc6021e3cc6015057ee5dd69d725fb6868cdf7190fca3321

  • SSDEEP

    192:HMpe8/EmUyPooFWPY43d5pVOKyncGC6/M5pBDG:Hj8cm7P5Fe3jrOKOcRD5X

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2