Extracted

• • Target

    New Order Details001.exe

  • Size

    674KB

  • MD5

    58c6327c00cdd8af95c8e6fcd1570391

  • SHA1

    c4af72cd2f67424b54614c0985ebf57f79e388a6

  • SHA256

    1295ff5f148dcda8475e87b2070c2f0f09e78e70072fac1eb9ca71e4c76b9c24

  • SHA512

    9d843aaac71b904eb332ef52a5d1043435d2e28c8583ebae79ec1b8c16a365488df83b87dc50808eb655293394ed5cfd3d150b27965c0aff3a539f19d501ead6

  • SSDEEP

    12288:SAZMg2XYlgXBaoLvtG7Hgd+PDCoeZz6licNSFh/wsq1oIIRMMrnIz3:vp2Ioo7AA7Coe1VWSFpwiIgZ

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2