Extracted

• • Target

    AWB_Ref#339720937705pdf.exe

  • Size

    599KB

  • MD5

    8f430690b8710fa451e213dd0b2ec9ab

  • SHA1

    de4b9701915a96ab28ad39dd5bc13be1941bc095

  • SHA256

    c0972bed1bf730f5247f0ee2db6fe2f15b97217b6cfb42a024dc3aad4ec20341

  • SHA512

    eda0d36ba72eec1b1cb5f95e7e7c676a89338f11cd7f2134fe114ac353447aabf4cc54276795dcd46a668dfadd597d143d2e2749fbb0f8b35d78df11da91aea2

  • SSDEEP

    12288:65SRmHfMaVj/IkS2bNVoOs/Jn+jiA58BrgiIXsh3gViwt5XHUkR:uSRmHfMaG6bNVfe+jp58Bsiysh0iw5j

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2