Extracted

• • Target
    BANK_PAYMENT_ADVICE00978.js
  • Size 808KB
  • SHA256 83bbbf8a6bf9ea4459e8b1be75a8ca18f3aa6878373c1dbf8202be56ba585e6c
  • MD5 fefefe77ee4a51827c1188d523abe855
  • SHA1 a0dfd6504eef6e531330f15325981ef7f05955c4
  • SHA512 6e71fc3813c7d92d8640160b09b87e8cf648c54c68aa1aa133938aa583a2434266b17b3c7dbe5846bdcc0e934559abc05eb14c03176adab29d4b99e9085af4cd
  • SSDEEP 12288:C7zLp6Z/IYEIzrgApRJiKK7XB7m3y70pJdCJ6EpV5NTh3+dN7:C78ZUYfRNKt7Z701CY8q1
  • TLSH
    T1F605F1074AC43FB5CB9C572940BD241EA3F14D9A6119A4CDFFB3BE4AFEA2304811B599
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionsnakekeyloggerkeyloggerpersistencestealer

  • Family: Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2