Extracted

• • Target

    Payment_Receipt_Copy.xlxss͏x͏l͏x͏..exe

  • Size

    2.2MB

  • MD5

    3cf077ee2e506e16cc65d9d93d2d094e

  • SHA1

    5e7b08bded387f0df8f01e9c15a4b10dd93fc33c

  • SHA256

    0374f4818c6b9ea88e9a8e8ae7f36ff7a7c66704fe110e3005b5ba6704d4edc4

  • SHA512

    cab26c72ff371a02e5e5576d6bcb0de06feb7b0b3d87671379107ba83ed3f38004f0de1f02f52fe5680d0f5c4d1529753491b9325de79756962eabc2113252ef

  • SSDEEP

    49152:5WiP0wV0hJ5VGx6ODJ1+nEtWX33oG1SdvoGSbVUWE:dVUcUabFVeOWE

  Score

  10^/10

  snakekeyloggerdiscoveryevasionexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables RegEdit via registry modification

    evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2