Extracted

• • Target

    HTWP0987600.bat

  • Size

    527KB

  • MD5

    3f48fc323c58106614bfe2719971411c

  • SHA1

    47b50ce885d36c013a43b0cc8c235608277caf7c

  • SHA256

    806c4451b1153f5453fdf0a09465a1f82018c3f01b3381a559564143f6d13796

  • SHA512

    a1e93d845b9007622f2d634d346754ff1721d4769ce9200ee2902f81e8e51d0d6450fa1105855b143f50567509b9aa43d64d8709ac71ed13575793490a816b27

  • SSDEEP

    12288:u6Wq4aaE6KwyF5L0Y2D1PqLQxnE3nmtzvF8wWVa:0thEVaPqLqnVy7a

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealerupx

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2