Extracted

• • Target
    MT APPOLO PARTICULARS.exe
  • Size 630KB
  • SHA256 516caa5876ff1a9e76d69c69967090ff8556283402109bc76e5e5d896bbc5a0b
  • MD5 dacb48d3616556709544bb9d99540b6b
  • SHA1 4607f2ed34f87698b4496b0f488e959fd1cc16de
  • SHA512 b08c26ad046637afec556f7c731e56cb47e779d0149bba2757acfd0e4a05a63b2cf64ec292f963c9eaee8c74fbe36e70f0f672319f9e64db80e5d695184b950f
  • SSDEEP 12288:QBBf7uybfFa0cuxP6iXSI8bOV3Jo6qpVwQIfrnbiHo7Pv:Qvf7uyTFa1YPPXH7oFnUrbOWH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionsnakekeyloggerkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2