Extracted

• • Target

    Image PDF.exe

  • Size

    189KB

  • MD5

    fcd532931cbee93b33fec3b865847411

  • SHA1

    5b59b18fbc8218cb554e90af2449757d90aa116a

  • SHA256

    3b026f6a862b24e645a4696c79169960332752e2aa15d92081d9c101062f1c7f

  • SHA512

    ca9125c4dcb89842add947d505e77780d5ec2660d90a5a5ccaf1b9d6c8e3e4984734be423670bd06e68dde7f7f2d0ba1246adcf8f072b4f8d025b732e0a1e70c

  • SSDEEP

    3072:oqbtYfYoWAvduC9hVWYiEVcPAMFP0+SbzdEgFqFRJ4H2M/dOxdJz9ry1K7pGIR9l:obzWkd9hV/GJ6+2l/oNzwd

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2