Extracted

• • Target

    New Purches Order.exe

  • Size

    688KB

  • MD5

    215bd941e8a1ba1f7022843f3de01c91

  • SHA1

    7e998134c2c6f87e80980de76cc28008deadce12

  • SHA256

    068e05c944faf172cf83584b995dd98b6ad77a42df01e0bda06cec52eebc3074

  • SHA512

    83edb03448704f3cbfcbe55bb61bed22ecb6f718376d3909c41ba3c0e99b2398ea782da40bd5ec0035d4c8a0e4a44f6ff7634c90675acd221925eae8083cf331

  • SSDEEP

    12288:6bBHH/DneK/ED6W68jGKFU7sxYTX3b94ZbM+4qwX3YYrKlnRPjJQPgPfd:6bVHzeH6D8yK/AbSZYTqwX3YYGlRbJfd

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2