Extracted

• • Target

    RecibodeenvodeDHLGuadeembarqueDocPRG211003417144356060.PDF.lzh.lzh.lzh.exe

  • Size

    964KB

  • MD5

    ea8b4c3d18a9639aeabc1c8462025ecd

  • SHA1

    d37687fbf45d943c324a8a3414848d707828115d

  • SHA256

    551346a913b6ab820cafab031e1c1e6648c121d355071b4411dbcf96357dfd79

  • SHA512

    846f00c182ed55d0b5e2c2ec78fea5be90e4dfd8538d9baaa66dc7f8d86986f56fd506fef4c1b3f20a678ac25f19cf760613790d4e11a0116a9161f5d4e67395

  • SSDEEP

    24576:4AHnh+eWsN3skA4RV1Hom2KXMmHazzb53ug6C5:/h+ZkldoPK8Yazzb5e+

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2