Extracted

• • Target

    order452000739355.exe

  • Size

    640KB

  • MD5

    2ef5e80bf4e6f0d3029f1bba361420f7

  • SHA1

    42f1c5473f6f40ec13bdc2cc4c390c3915942a67

  • SHA256

    2fb7505c8296c864ebf2e99348f4465997be63da7f99867170772a7aeea7d35f

  • SHA512

    476ca7a6c0a19be26a33c68ef762bb4e1ba199de55e3807c7787611482923942b85b3ecb0fe4c559bb79d46b3a6f9f442d064e7ece7642c32b9e66f09a3fc983

  • SSDEEP

    12288:VRco9fTeXwDxs86uRA0MKQ/lTdkLGQaoiAU/f+UQhs5aR8VI/B:Lco9fKwDy30M3/lGtaoVEvQh1R8

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2