Extracted

• • Target

    PURCHASE ORDER (2).exe

  • Size

    881KB

  • MD5

    20a391888281aae1523bcf182c1cb4e9

  • SHA1

    587eea4c6fc96e91f316c60f31710071764440fa

  • SHA256

    16ac39458488454a5d43d2f0d250fe014bf22ab1542ee6cbd10c6f69ab8d91d8

  • SHA512

    98d5604761ee0a227d294837aa3c0d13145387f12bb3796aeaf8abc4d126c0ed24f3d75e3b1e6f04f15c072ca46bffdbc3ae57bb2e00b74567f390ee9077e157

  • SSDEEP

    12288:rq15gMrgh3LbQb42hkSJsrg/S2rO8egXsyFIxN4Kuw+3L6tXju:rqLfgeE2KSJUQYIs4IN453LM

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2