Extracted

• • Target

    Purchase Order 0156070.PDF.exe

  • Size

    585KB

  • MD5

    536a5ff0f223a0ce1fa5601624a91f1c

  • SHA1

    e785ec6acb47820681a2047388d3aa4c3f008e7d

  • SHA256

    f2d0ccfeeee010d03dbd6ccabf18e33fd6de842be318b5a800ad7793848ea410

  • SHA512

    0bbd1eda03d8302d73d12dfeb85cd2470ec2a3217098305e7c7f1385e2cf89ac1dc884c9f1997075f7d61cd01b82a98ade1c6b3080821e4801fcea0ea749ada0

  • SSDEEP

    12288:fTdYX9KMtD/F3LjRULYFVbVmk8mADwrbTeLKZk7WW5Z:GtRtDd3LlULUVbVmpmIwrHd0WW5

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2