Extracted

• • Target

    Qaovmgmn.exe

  • Size

    1.1MB

  • MD5

    2fcc31707bfa6f3b9a82ef482e81f08f

  • SHA1

    f820b95c7e9d10d951c3d48c2b491b64ed274534

  • SHA256

    6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0

  • SHA512

    1cfa47e1a602467386b11f86a67252046cad119f378c2f09362efe60c7a9ce8e6ba26dd452d87e9dd6f7c1de00682a986495f4ec3708c15440441592a65fcbb9

  • SSDEEP

    24576:Pt4rexG2D35fmUw5UpCZI3M3xr7KT8LwcCouwvxA688j:V4rexG2D3nw6pCZyMhvKrrTQxAl8j

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2