Extracted

• • Target

    EVP3410001500995_1506489088-payment order.exe

  • Size

    45KB

  • MD5

    3d66305ed410fad27c043db895cdd385

  • SHA1

    1038de840abc4effc9092a240c7fb8b088b7731b

  • SHA256

    6ce2dc1aea1d062b35b2f1e1bb8ad276bede32a26e51581f996b4af620764863

  • SHA512

    95d56b572aa8322b93a683e7827f6732c58f0c10f1cb41381df68072ecb6c58182ed418af4207f3e5666fd369224cafcc8ba8a5a3c9c71251abd58e0d65e719b

  • SSDEEP

    384:d8vpxocE2w6L5FUGWe1fEt5m0Gg9azYUmreMRo5CRCV5uWn+FW:dIo/QnJ9gloz3MRRMi

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4