Extracted

• • Target

    ORDER-6070Y689_0PF57682456_DECVC789378909740.js

  • Size

    7KB

  • MD5

    e961e6c85529967631d08dc53a13f0ae

  • SHA1

    53d75f1fd3dd3f5738b395d6e66147f8e934bc7b

  • SHA256

    1f0ef4fc5add951652abf5703c97934a6072ba87ba209f0ba1407ed466f6bb98

  • SHA512

    f5ef8f0aa639238c6dde4d1e80cb6d80ab0ec8904eb4f2cfef332ae9b2e033bb2ee4cb1fc8012a7473dadd707e5847e6977d66c239e0efa3d95bd0cf8f787c4a

  • SSDEEP

    48:7PB7fqihtV7wGF7OE3qMdlwURxp7gltFYpHwmAhHmY6mn7U7f:7PB7fqihtNwm7OE3ZfJ7gltFYBZYh7yf

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2