Extracted

• • Target

    PO_ESTM36_QTY_105MT.exe

  • Size

    1.2MB

  • MD5

    b797163d4e0060cd23e1f35e45576e4b

  • SHA1

    872a7c0df1e1aa6fe1def0816f373a072fa87b55

  • SHA256

    c4cd9b5ae0fb9e561cc3aa7d76751091771fcd4fb868425a3dd425b940dce753

  • SHA512

    4f11b6b3cdd42cac0c9bd5dd6647e33d6c3ce0f2407f8b19aa02c058b2532a329b09fcb561ba437df94e45feb3f84b1b86c4a3e26f1d2354bf5d663f757a656a

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCJFauIHvTpzBOykZOBZ:7JZoQrbTFZY1iaC7auIHv1tOZI

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2