Extracted

• • Target

    Order08052300897456121.exe

  • Size

    1.1MB

  • MD5

    452d8d96c3939cdb7d971c43c90507c6

  • SHA1

    850784b8cfd6ea6417d7124be94c4d3aadf1f5ce

  • SHA256

    c1057eae2e5b0db167398f16b072ce3d291f11ba9e295d228871219f683aedcb

  • SHA512

    5c79dc64d74c62c48cff9ca05ceabff5c2f72478de1f60bf52b60868526c9a46f10f77f2936661b2e114c3113b003b87d6d9899793b476bf3c5eb8ec4a94ef82

  • SSDEEP

    24576:Vtb20pkaCqT5TBWgNQ7agLebT9kMeBUS6A:GVg5tQ7agLef9S5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2