Extracted

• • Target

    PO0909898899.exe

  • Size

    778KB

  • MD5

    8b3f52c50a2a676c6c8767914eb7e5bc

  • SHA1

    2936603dba4c28a2b1999d6a72f1443d502ce486

  • SHA256

    6d3ffb896e637867433266d733f0a343f51e2bf02c0ee58cfc45967e650966ac

  • SHA512

    7c4fd27e0d7ecec3ef8f84b79f2f989783c3865d1b61717d8c58af23d1dd3a085cd6b627c0c1ea120803875443a7c9a915c02d5b0800acbf23b914fd7959204c

  • SSDEEP

    6144:NSDMpra6XVknq4yNLwNBXUtTpN7m7Vbvrvo:hp1FkL2c2pWx

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2