Extracted

• • Target

    order specification.exe

  • Size

    484KB

  • MD5

    bf2e61acdf0a0076c279fbb68f460d6c

  • SHA1

    19e7d28666cc0ceac9a728a9564761220a709d47

  • SHA256

    643ce59d197d6910d9bb5f5f24ffb95e57fa3c9ad93a8548a5ffa1cb4917df4d

  • SHA512

    11ca8e05981c2abe05c396b33fcf07bc91ef36f1ff3b35d601c22e13681590b97fd62c9c7ca73efc971c67f93bf02fc86a8b5b5e43967de0e894e8271345df0c

  • SSDEEP

    12288:y8G1KBsGhcbWFP7ajE9iMg2WMN5IAk3w0/VwSZovH5UP3:2YBfhcbMzaj4guyZs5UP

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2