Extracted

• • Target

    PR-250116 CI, PL, AGLC2501021 SUR BL.exe

  • Size

    612KB

  • MD5

    8a67b7c17273ba3a932aa9efaeed4689

  • SHA1

    726a7774525cf246338ef98f26cd4c70450aea3e

  • SHA256

    6c9bfc38f2dd0b8e0ff1ae18e0286fd13cc7f27dfadace3a6663ae53ef3c1ed0

  • SHA512

    d8d239f832388c6faa32901149757bb481be4304db5c0192d876d4453cdad925662331eadf2b738e86f98d0ea3be517c3f3a19834af8039019339b3409f186eb

  • SSDEEP

    12288:bxgmHugv1lqu5+hQBgJwKH7uYnFzJPaXXR+dR3JcK3Tc5R5v/Xs:t935+hzbfF8XXR+dR3JR3W/

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2