Extracted

• • Target
    Purchase Order_pdf.exe
  • Size 2.8MB
  • SHA256 e74d8a9446cc29fe3cc0502ab4df804c265761e5529966f5702ff4690031225c
  • MD5 06ddf95fce6d18a63fb14c35d2ee791a
  • SHA1 fe032bdf3108536a9d7ccc2cb939012884249dd0
  • SHA512 d251cae79c934e864eaef2fb87c0eca2ee1af14e42edb3d46a8c012394377ce54b279c707fb0d0f9de7d8b632f67ebbd7fd8daae91b764ebe150b56a9f646e88
  • SSDEEP 49152:d7oZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGV:uX0zlC6me98Y5Q1a7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2