Extracted

• • Target

    Enquiry_20240210000.pdf.exe

  • Size

    618KB

  • MD5

    3ea0418567ac5a59f59094095df41e17

  • SHA1

    1a18e0028289315358716b7ed440dd983c0b0458

  • SHA256

    c3ba097fa559c09c855f8e4dfe8768c82d6d5005eadf4c4ea384b650ab54a06b

  • SHA512

    a227caba779eb5fe8ffec665e3afc436d0eeb0d4fa8be84ef5e8a60b4b22ae7dbefad166ea23a1930a56a8c6a8a0cd516a7c3057ce2073c6018817f626b832b9

  • SSDEEP

    12288:xXHmQWtBHPtkZB+W7WxY7HIkjJxppMbDkIvjUZKXf:BHm3tBlaBJ7g4HIklLIvjUZuf

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2