Extracted

• • Target

    Factura de proforma.exe

  • Size

    707KB

  • MD5

    664a19476de212a8f36e094538f512ed

  • SHA1

    6f41bcca2529af8b929cb0f012ef155750796e08

  • SHA256

    5044d3f1ea725f8e5fc050acc3e662620a97d498739968d35893977ebfe4d039

  • SHA512

    cb764b6fce5681d54aba60d06d2b362c35626b27b31b5e7e77d07aa7334ec75935d6b88e810206524a1bf2877f8b852e1c97202a10d44477a028d021da4c7128

  • SSDEEP

    12288:LgMKhM39TXsTAi18rjXeJGeE/l1n7WRwzbyir78KW9t3zPA7cH:EMaci18rwGeE9dwYbyijW9tDAQ

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2