Extracted

• • Target

    Swift.txt.pdf.exe

  • Size

    508KB

  • MD5

    330ca2b7317ef6e82d8868e6c713b26f

  • SHA1

    7bce0ab5f04ddb83c5c9c2c7ead4c786fd0e4d00

  • SHA256

    1a0b400c17de9e90130c9ce738389e3371f72e20c72bed672b732a3fc6bb1b21

  • SHA512

    4649256ed88dbd5fcbfbcbdd054196541c80f582669619a7839c2464632ffb0385f4cc7c3c32afd2ef1023c1bfc9d85d55de19983c10bed075828232c3f9f0d0

  • SSDEEP

    6144:IGtShSALi0YhM1I51H2AUX+fVB3K9FkyVKWQQLZJR03/bbOMj5LgaVzxtdX:IG0ghTDsuf29FREILmvPOMVLgaVzR

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2