Extracted

• • Target
    Statement of Account.pdf.exe
  • Size 639KB
  • SHA256 f72a28baaee398dbbd65efbdae0cf4864f208f806f4592f8f6bb7c9a735c2362
  • MD5 2224d84e4d75b85aa447e2a0bb5bfdc8
  • SHA1 f9afd500770a423c06ea55122f26c510626fd391
  • SHA512 f1ec27ebe21576c4a9db8eecbe4e8790f3d3bc8d52fcc5baf851bdc9f8911919c3807b99879d36785998c7fd12d5898a654fdce5e4f660969a97f4b71216064d
  • SSDEEP 12288:IeJ/sIAglhcnUwW+g35AX1MsrAOqWls5Rqc81vNIumLsqZjItimOMt+j:Nyn/WSFMJXWlBvNzmgqZjOimX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2