Extracted

Extracted

• • Target
    Vessel Particulars.exe
  • Size 688KB
  • SHA256 0cfce3e53dcdb056caf79f5cdb13fbe512e824945e5e1ee09b241cef476ff971
  • MD5 c97774975938b0555355696b760d6bc9
  • SHA1 c87bb469eb4e0087964194d70be070502b778b31
  • SHA512 b02b7ee374e2f339dd66fc23637c46cdf52dba3e55db8e76c9f4bdb22fc0c0b0c1542b6bcf7f35b43bcf195fd905fa465c2451bf298711243ff0ae4878c53f31
  • SSDEEP 12288:J1eW7CyQpbYdZQ9QJ4xWmOn5Utk8ZZxstz0Wr8avA:3eWOfS7w+kiOHstwC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies trusted root certificate store through registry

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1