Extracted

• • Target
    854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
  • Size 867KB
  • SHA256 8ec589783ee99df7f41c722cd5e082a377a24d8e0f26121ade720132e09a574e
  • MD5 09fb10ff745dba892013f47e31438ef5
  • SHA1 60eebac8cdeefa1392cbd5009f53e919306736a2
  • SHA512 b5ce2184113bb772b24888e97080d17ca4222ec83d38c4719d443fce7cc64bbd574a38118bc09bc8a675e014a8f8fb9c2f789e9c9cb2eb468851e9f6377c9d5b
  • SSDEEP 12288:xzbw2iNawENb3cOQ7bZLscAXxZhzX+dSngX3ET7yyeZHHpYw5NegHCTXvpr7QDbx:G1Qwe3cOQH7AX5zu0ngOdeZ2wEXs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2