Extracted

• • Target

    SMP_0001924_930MT_PDF.exe

  • Size

    1.0MB

  • MD5

    a5b62d982db9a3841c9c3f381f25146e

  • SHA1

    f9c714ccd984e7f7bfef5964ae761b968ee74828

  • SHA256

    5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8

  • SHA512

    5fe9b5cf77939688aa62713941d1bc4c419d1d4442d154bae03f4e950798a4772cd4396efba4e55f5d6f3baacf1f8fbf7ca9125dd4223c40ff5e1ad951f0fd25

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaajQr1zoxHHLlI62zZbZVz:mJZoQrbTFZY1iaiEoZ0VDz

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2