Extracted

• • Target

    Purchase Order.exe

  • Size

    1.7MB

  • MD5

    1967f948fc281d1217739c9aa5b05d6b

  • SHA1

    c2b30a0a3be5b4671218ec22ba4d58f155a054ca

  • SHA256

    452f83faadab38d84bf3593ed94a45779e32dcf6008ee382c41f47531330e7d5

  • SHA512

    2991226e8fe34ae1e60426c56d7f0bd91b1f25e7650bd54930484e512d1827ef1e24a9691c3a8e9eca4fc8f719ca4f6b98c9e75f96bb7a9fc082079b4e9accdd

  • SSDEEP

    12288:7mOvpE6rn3e3GtugblwJADA4U0JrhdPjaWDy75EYzqR1:KOvGIOW/blwa0E5hZjaWDsqT

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2