Extracted

• • Target
    854F1E97-5DBB-4A87-A566-33D9012B05E2 pdf.exe
  • Size 369KB
  • SHA256 0a6d0d3564e7e3a9cd3c0f186f8f5ab59c70551af31ca1dbcbc5245062ac3cce
  • MD5 21776c50343431a5f4c184b9544d2819
  • SHA1 44d2b70c9049fa105d076ffc12a3d5268034d53f
  • SHA512 276834840a02f7f057c531b9d1de885942f214c53074fbfab1b4a2e2d6d10ed0cf99cac6178b101c74b4f60deaffa8174efcb0efadf3d349058a0fa4d16c8102
  • SSDEEP 6144:XoPOHwVewzWQCspBoff9l0y8u9sm7ZLHNYiX4c+69:Xi7NsUakoymBttO69
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2