Extracted

• • Target

    New shipment AWB NO - 09804480383.exe

  • Size

    1.1MB

  • MD5

    c30f0328acefe083da339f7969a0fc3f

  • SHA1

    c87d4ebc83d8efa8fa31e60f79e83205d436803c

  • SHA256

    ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee

  • SHA512

    9c3231702c24a151c938dffc7bf16338881c0c94ce09537f24ecbf0d1ba3469fe6bb89264a8fbaa2782cf59e8582d9eea85e6c4bd1a965786478df6b97d7b427

  • SSDEEP

    24576:0tb20pkaCqT5TBWgNQ7al/psVTZa7VVxVxo6A:dVg5tQ7al/puZa7Vjc5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2