Extracted

• • Target

    Shipping Documents_Pdf.exe

  • Size

    1.0MB

  • MD5

    555219b2b681da0f48f4c2394ee04855

  • SHA1

    96f59a675baeb6f6a363920abff8906cb17350d4

  • SHA256

    69b55bbf73f29774d66ed8da3c99673da991632f347fd99b2a200aee80aebf7b

  • SHA512

    81938c46020ab3f906809f7eadd321eabc177248c8064ee35fca69ce868017af0d44091cabe687f17961fdedf0fec36e39cecf6dbc2d9d33ba2e52529656bf32

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaajkdBz28cdmUu/Zj6l/NYG:mJZoQrbTFZY1iaikGMbj6l/qG

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2