Extracted

• • Target

    7e041a3670abd581eb735dab3a66975fafd7e921bb0f94a36b98829248462f8b.hta

  • Size

    129KB

  • MD5

    7a368478a9772fc6e87e8eda7ec7f7b3

  • SHA1

    237eff7ffb66ca9507fdbd5512506ef4cf81a22d

  • SHA256

    7e041a3670abd581eb735dab3a66975fafd7e921bb0f94a36b98829248462f8b

  • SHA512

    114aa191194efec173adc3ab137eab58454854efa5109da30364b54108a74ccf68b66c659a9609ece5933aa72ab5997f7b93e510e37a51ebed51d903cbc4fe17

  • SSDEEP

    96:Eam73EjaILjaeRVfr+ZqTF1OF3ja3jalHjaj7T:Ea23EuauoVj+IGu3u1uPT

  Score

  10^/10

  snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2