Extracted

• • Target
    HBL NO C-ACC-250002.exe
  • Size 532KB
  • SHA256 0231d2d9b4bc4935dd4eed396ec39b0a6ed73bf239ccb2a049424175e42b42ce
  • MD5 bcc88695eb4028e33671f80ec957a01a
  • SHA1 67564ac4019e2fde2e083d00f7effc5c63d48605
  • SHA512 943c08b8112d3fd1fee2d1196be95db63051c97381d1348e26255b0cf3ae5a142b72ef6542f48e889828be00c6426c203b9828394836de82f617e1c42507c6cf
  • SSDEEP 12288:+jqb+0LeY8oZ4MKb7pI1hrtH+/lk0JW9rrrbni4WeP0pMniRQvmmMZHVP:+ja++eYJyPmvrt2lk0JO0pMUqmmMlVP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2