Extracted

Extracted

• • Target

    z55PleasefindattachedtheRFQinquiry.exe

  • Size

    2.8MB

  • MD5

    ee24e64f34a5580c5c9ee2cebefc312d

  • SHA1

    3a8a93cd79b36dedfd0827f268d210574c66f9bb

  • SHA256

    a42b85487137aef36ca9eb586988d2ff2181425c1ca8b0deaef5c30e4b6503bc

  • SHA512

    8d37331a15367009fa56cbf03c0e66730aea15fc5b437fe4f8070d9b75f12d102a424196a033cdd5ea40abc1aa5d205dfaf44f4fd49008921e22f01a59122321

  • SSDEEP

    12288:QeQU766QpZ72faJZxZtohjS902gSo+nknSsi1JqWlVHQECjzW:QeZnQpXJbD4IYus+J1/NC2

  Score

  10^/10

  snakekeyloggercollectiondiscoveryevasionexecutionkeyloggerstealertrojan

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2