Extracted

• • Target

    ORDER0869786.exe

  • Size

    1.1MB

  • MD5

    91cf2ce8fca2f3656fb2518fba04710e

  • SHA1

    eee8109d8520e5589308e9901d762d903906d5b3

  • SHA256

    2f1d9da7f9382f2a8e97474d0ee540abede94da80051b831e6b926126ea9ce40

  • SHA512

    d254d1ff59211f42a6d6607ce9acd626dcc220f8e5c314ff2420c29f190cb25c44ba29e9474e7cc07ba77272a4ec8900947f0fcdf84f4f51f7f251d14173ad56

  • SSDEEP

    24576:zAHnh+eWsN3skA4RV1Hom2KXFmIaOd+4CvsrdVtA5:+h+ZkldoPK1XaOd+xvsvA

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2