Extracted

• • Target

    TBN PDA quotation for discharging cement_pdf.exe

  • Size

    1.0MB

  • MD5

    b74a162efe4f52f43cc67d126c2f8d77

  • SHA1

    f01917d3ac9397cf878d389b34da3d738894b627

  • SHA256

    2bc4b7908e49fb1b4bcee9fd51702a318423945423b88ce55dd28ef949e2ed27

  • SHA512

    446efc78726d511c79daae46449c19e96aefddeb1d08914f4e207b28377837a004bf0b87b46025a18845704af613651e273485d356e5e646946a92af711831f8

  • SSDEEP

    24576:q1ChsCThcQJJTrYJlLs+vjKBUbgh5jBcxG:qwyClcOJTEJNgVFc

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2