Extracted

• • Target
    quotation request 19 Aug,2024 pdf.exe
  • Size 697KB
  • SHA256 7d50338fe1feeb6944bfd552e44f266d764dafc089b853a6ee24f67ef322c124
  • MD5 7741af3b1c3b0315e179b4fa09615f0f
  • SHA1 b2420da7fb6b1419c0c7025508a6459e9e7ed67c
  • SHA512 c3b612948f6b666bb46c9f61ef6a80bb5e62ba031341a83536bebcd2889fe115a2aa1c2f80d3ad6a71e26ba02673e25b4addc2dfc01a573f550be21e5fe3f132
  • SSDEEP 12288:Tz6AMd6OdKEari+7ILC9DVUrdLiv3HeS5Ai0UCXKfKN:Tz+6h1OJLOVUBiPeS2GCXn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2