Extracted

• • Target

    Payment Slip_Pdf.exe

  • Size

    1.0MB

  • MD5

    cbc85c6e67d54fbd245e715137333f99

  • SHA1

    92225d2d10b0894eb9aea75ad9e5d6a230c5d290

  • SHA256

    5911349922ae05bdb94047a5ac5c6070b79583380a277e88ecf9d74ba7a0d851

  • SHA512

    fe09671717697c95ea45ab4c08e76e33d6709d59fa217301c4fe0ba097aa71a4f13386e6d8eb0494ed91f87fd1b24da402c89e1d9ebc8618286914f887944427

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaajV1YVEpIxurZh/L0:mJZoQrbTFZY1iaiXYqpxVhw

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2