Extracted

• • Target

    3302-9333-pdf.exe

  • Size

    1.1MB

  • MD5

    9f061ed14a6be403487e1d5d9f57c1c7

  • SHA1

    14b8bb53f104da83ac047a2133b3c16b1c417ae6

  • SHA256

    8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce

  • SHA512

    9af07665a41a5babc582a8b45f02068e7f198ed93edf32c2721448b84fc92c6ee2b1844694079a3d335e5222df27666e4b6ae5f9b6e2725923ad92f8ab94e9e2

  • SSDEEP

    24576:ktfo6PTetbba1C/Ll3HoyhLLGmkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgk:Uo0etbba1C/Ll3HxHRpAuserKvpAuJMO

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2