Extracted

• • Target

    PO#I-24-0000217.exe

  • Size

    793KB

  • MD5

    26ceb57f7be2354a102ea2b6de6a2563

  • SHA1

    202682be94903b9f3d116b4da5663720b991c1bb

  • SHA256

    7ba7fe2d75fe74beedef97bee52008c4cf99e84313750b821c5202856d944e04

  • SHA512

    a7e96153542228048b954418de2e0be6df39eb5a2e4573881d9bb391a953f7cc13faaa576da60eeee301e2561c9bd05732aa7676f003513d628a3d054ae29a62

  • SSDEEP

    12288:iTf/rmIKE2pb57ISC3B9zwVQRxJXqMhEF/rSGYFqrQ6gE803yaISb:ih2t5sSo/zw0EXM6gER

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2