Extracted

• • Target

    Shipping Documents_Pdf.exe

  • Size

    1.0MB

  • MD5

    9bb18439c7365654deb878f914930ae3

  • SHA1

    74fd8c1ee282522bffd4cfd97bcddedb304047ee

  • SHA256

    757bc418a17212abe919bb341478274977b53cac81f70a260509008929cae6eb

  • SHA512

    3fa31761cd4064d8970b94801526d440b9a2cdb28054f85f8bb8442f8c9096df1a44ccd68a0808d29f30446ccd283a9acb002c00739378ae0d5040cb76b094fc

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaajnfuJuip2JDiH:mJZoQrbTFZY1iaifuJF2JDiH

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2