Extracted

• • Target

    QUOTATION#08799.exe

  • Size

    643KB

  • MD5

    60ddcafe705a37c0140c4cb0e9c78aad

  • SHA1

    f1027a78300c13ca9628a093452fa86c99dc27e2

  • SHA256

    cc13129324f50af1beb790648588af51cd58745cc19240836104b5441319ecf0

  • SHA512

    4ce31889a8c496c6881520fba3c9caf64323604b9d9d0e45c93282507b7cf60364a36509696b785609e1ba6060001c8ebc4610bd76a0ef105e67136b67539d9c

  • SSDEEP

    12288:numPW57u6MJZLtjsZ3x9iVeWErj59NcW23Sh5UCtjWfXl1Ewu3X3u+:nubKrh0hAVerv59NcWl+vl1g3X39

  Score

  10^/10

  snakekeyloggercollectiondiscoveryevasionexecutionkeyloggerspywarestealertrojan

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2