Extracted

• • Target

    quotation.pdf.exe

  • Size

    584KB

  • MD5

    cae995edd90312264f9faa534874894f

  • SHA1

    2a71f016765dc5fa825ca1f437e1df02c32611a0

  • SHA256

    5226c6707f7f1430f49c6c7cd637375b00004be37d815d82804257a8ca563841

  • SHA512

    6bd8c914fbdc8b04bdf12a8a60eb61324e4e06dfdd7525d29418c861247dda366e367992afd4d285a15b8ca71df5d28ddc1056cb91df3d9d1461c888bce8d594

  • SSDEEP

    12288:HrLfSC/W39Rfyyii2nYUNm8AEr8aNZibViwt5XHF:LLbcyyii2nYUm8AErTsiw5V

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2