Extracted

• • Target
    new purchase order21125.bat.exe
  • Size 710KB
  • SHA256 ae1a70825040f157d78228d5668ffa7f2759fdf83293e35c351e5b4e8d035c4f
  • MD5 581ca4f5f57c1301c959df445bc71d94
  • SHA1 60fa7a21db1d35f2919837f074228c5b0caa2b12
  • SHA512 c39841d137f253682c516a3a9cc7cf6919474d92705d4758ca9e06e7adf96d5e7f02a37ef099900796aec14dd0fe961a9be491674af8598228961506a3dc9ae4
  • SSDEEP 12288:std4fURnHb+Qv6HNbwVUd4/HOvySUYHjH6MgCrHIiLQ7WiJu9VKAJy97UcdnVfU/:i4MRHPv6tkVUd0HOqjYH76MrzIi2WrVx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2