Extracted

• • Target

    NEW ORDER 4016291 240043.exe

  • Size

    644KB

  • MD5

    f732e3f360a08319d434ddab7d14c54b

  • SHA1

    e085c99c0b2ceb1b67666673401d0c5a80cc1688

  • SHA256

    c66ae68bb8b705111729acd9afdd0285355bd8fa87e963af02a63ab79476a639

  • SHA512

    3b48b5bcaf43fdb258e70345be282042681a895562d6c3cc7dc08df667aacbba5b3f3bcc44c496f14b22be56d24083d63d6282a453d63935d619472266e465ba

  • SSDEEP

    12288:NoTtqGBa15pfdobPeJtcKxqaXgY3kXT7EdNGyMh:NoTPQlabGrcK59oodNGF

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2