Extracted

• • Target

    SCANNED_DOCUMENT_8D23259F053446A0A1C0ED3F526B0C7B_PDF.exe

  • Size

    886KB

  • MD5

    e22f1bbf54fbbd8d0135772dac71ac13

  • SHA1

    b44ed322c53cb34c9eb7988c65be76eb7c78f089

  • SHA256

    9e4e77d4f212e5aad71c2a0409c801b64e89b9f92a0ce4e2903b587bc5a70485

  • SHA512

    2e577425a1d81e682777ae7b8c0dd9718923f6c0b2367a0096b7aa803bfb21eb02a4ded17600f6f9767b5ab853ddff56ebd8b39dd0ab8da341257d2e50aa3d58

  • SSDEEP

    24576:14njPTfWh2y0ukcncNmGgvYTDn2KSQjHT5GA2ekyFh3C0cq:mmGhDneeQHMh3C0cq

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2