Extracted

• • Target

    Shipping documents and BL. PDF

  • Size

    562KB

  • MD5

    88987a164b8da9a0e468965352b76cb8

  • SHA1

    ed730734cec4225d60cc83a1cc4c4449f9bb7329

  • SHA256

    3b6283a00901c0709734f4d16a2fb4ad3fb93c913dbf45637664c74320c2d385

  • SHA512

    bfbeaa80a8b95795e7831e84dd790b8eb3d2eea1be47bd42b7c709eb4e427b206fb5353879c9ee75cd72ce7316e95e3b162ea8ebe9407e5a599bb47986e4efdf

  • SSDEEP

    12288:+ZZDecnPMABfUnpVTVn80g3F3Ok95oky+f6kpH9:mYuUjF21Voroh

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2