Extracted

• • Target

    purchase order.exe

  • Size

    441KB

  • MD5

    b0783a18de531b50debfe5252bc25558

  • SHA1

    bc564e0ceb0e8f99602247bcc559a583f77db8ce

  • SHA256

    018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f

  • SHA512

    927ff7d89d9820745ab5208793444ade73da993b4c482f31297e093cb9d3cee96a8ae0808c1a4813612d61b1eba4e7d40bc7d9c037f4e337f5dccc4228c25e46

  • SSDEEP

    1536:TzOp02gL1jszmCCCCCpCCCCCTdvCCCCCCCCCCC3CCCCCCCCfFIeCCCCCCCCCCCCv:TzSY+zCdsP6GBxhDCovrU/s

  Score

  10^/10

  discoverypersistencesnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2