Extracted

• • Target

    PROFORMA FATURA pdf.exe

  • Size

    2.3MB

  • MD5

    a30e9b58b16c609e63db086c39fc5c83

  • SHA1

    c4d0933d90088ba673e17bcff3efd52dace7e8df

  • SHA256

    f278e9e47422ea40eda7002194f17872643ab88366e84124813f161b28be9c09

  • SHA512

    2a1bdda4e3c2ad2ad312acd87d16f4ccf9dc6ce3b50941d1771ef53786da9f91c71629096c3403b7b48cdb9ad215facf958a1353c5f0380b846987c9da90ea7b

  • SSDEEP

    49152:tDCNmXVrxzzilHH+/EZvwN/Idbze5QYpiDLT+s:qHH+cZvPd/ew

  Score

  10^/10

  persistencesnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2