Extracted

• • Target

    INVOICE ATTACHMENT.exe

  • Size

    1.4MB

  • MD5

    7e57c6de8dadb8ddf8d16035e0347783

  • SHA1

    6c6afdaabbe8ddb12f0428f5033b55f1a34910f9

  • SHA256

    d6d0f637ad8372d18fc34e66db940fef00fc9816d05faff39f7c3ff8c3ae0f8f

  • SHA512

    f54e3e7a607a51ac6b773060627d5eaca58bdc9b03bf74f41f2d3c463c0a52c88d250b7e175cedb256b13ed1364e90e8425aa11a51ed3e7b8b8115bd8f7077b2

  • SSDEEP

    24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8aN/0oCphCrT49LOkNitwfj60t:YTvC/MTQYxsWR7aN/h/rTGNiIjj

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2