Extracted

• • Target

    DOC030222-03022022133454.exe

  • Size

    1.0MB

  • MD5

    da5558d577bc06aee8fdc31573e16e8b

  • SHA1

    19dcc73673d51881634e62f15777d68d10282f4a

  • SHA256

    225cb7a49a547c618fd4eb385cf953086f0623165aff57044351a245e0293d2d

  • SHA512

    3f25d44709936c7739c02b1ad993a10395d71c0b560d58fc9bcb6e24abf357d2fc6b33d7d2713e9836eaba1764ba6f5d27c5c0ac5122c8c496d12ae31dac8783

  • SSDEEP

    24576:7Cdxte/80jYLT3U1jfsWamvlOXaaDq+NDQ:Sw80cTsjkWamvAXLhO

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2