Extracted

• • Target
    urgent payment.pdf.exe
  • Size 765KB
  • SHA256 c56b76378b1c971bc21dfb6819a1578ef694bcaa4cf5587455edffb2f3ea72a3
  • MD5 2b4dd4626193980bbfc57c66623b9c47
  • SHA1 ca210db87d2659a926d3283a960ec839b012b2a5
  • SHA512 57fab6afb123c07e393cead1d5056b583d342bd261590cb0b0f31e2a784c37bb8d59f1cb604b122ba330323888cdb31d7202bc1b49ca76a19ccafd0f2717c8e7
  • SSDEEP 12288:Nbs/OxWyyfIPsjXbtOMaoRGDvZqTbQuhiGB4DgJ7ejgvPX:XTyy0hKmKhqYiiGSDgJajgvP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2