Extracted

• • Target

    newpurchaseorder21125.bat.exe

  • Size

    710KB

  • MD5

    581ca4f5f57c1301c959df445bc71d94

  • SHA1

    60fa7a21db1d35f2919837f074228c5b0caa2b12

  • SHA256

    ae1a70825040f157d78228d5668ffa7f2759fdf83293e35c351e5b4e8d035c4f

  • SHA512

    c39841d137f253682c516a3a9cc7cf6919474d92705d4758ca9e06e7adf96d5e7f02a37ef099900796aec14dd0fe961a9be491674af8598228961506a3dc9ae4

  • SSDEEP

    12288:std4fURnHb+Qv6HNbwVUd4/HOvySUYHjH6MgCrHIiLQ7WiJu9VKAJy97UcdnVfU/:i4MRHPv6tkVUd0HOqjYH76MrzIi2WrVx

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2