Extracted

• • Target

    ATTACHED PO.exe

  • Size

    682KB

  • MD5

    725fb3ed1ead4088f2768e73848d1e5e

  • SHA1

    5e591ab78541b8b6466272b908bc838c9a23b51a

  • SHA256

    8a1bf33963b303e0cb465a52b90a6bd044aabca5b26114e747925f60c5145845

  • SHA512

    ae3acadc6b40e1712c0f1b8dde0c35e3a81d61c6542ba53a58d747adcbc10fb1ee41c90c4ab477fded8b9df7f443e7c659e7038513922f2482012fd67db018f6

  • SSDEEP

    12288:b+VRXfEBFlVYJaLWqYATN1Xa5nnp1XHhCygmjcZCY5uGjqFUUajGgo4/7xefp9M6:b+VdCFlXLfN1Xa5nymjcAc9fUaNteh9X

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Downloads MZ/PE file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2