Extracted

• • Target
    Urgent RFQ_AP65425652_040621,pdf.exe
  • Size 901KB
  • SHA256 7c98a7aee7d155bc8632cae1ff09120f88483adfa77205e6b74253e9d652e2b6
  • MD5 8c7db0f60114f1058474a48438072cac
  • SHA1 ef5add5bcc8eaf1d33a54a3820ee67c1d32ed452
  • SHA512 0958e802c0a666abd6226ea04877ea26888252bc91e148c94e31e880e0f9974ce01705fc229af32a90b82500b9622f4525a125ae16ee451a5552e8f4d3fef5f2
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2