Extracted

• • Target

    NEW CUSTOMER ORDER.exe

  • Size

    920KB

  • MD5

    86a2dbbbbb42f4bf586d9fedd863739a

  • SHA1

    5bbb1d435db8946304af597fec929c4814fb9bee

  • SHA256

    7605dcd7b056353b913434a83f65aee2e9adf3b6eebe9dca3739000db53ddee3

  • SHA512

    b04f4b0a8f9648f55cd82071064d7a7154b72316302dc57d0e879c4a45cfcaeed4555755a1baab77cf79e910c0afc22e6ac9496a4d40830bdde0845a6d08ac23

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QL9Q59VzxdPxClzCUTXDbJPj/jLLK+PB:ffmMv6Ckr7Mny5QL9Q1zxJ253JrLLK+Z

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2