Extracted

• • Target

    dekont_001.pdf.exe

  • Size

    6KB

  • MD5

    e8988ad104148396f3bbc969c3e84a94

  • SHA1

    b2f862133633e4dd69debb0d12c926c7cfbfa29f

  • SHA256

    e83231fa6c8d4df75581b44faa0180bc822f28168e12ed7590ba8c06a879a55e

  • SHA512

    d736e729e6ea1b7d2a28bbb4da40b3b1202cfaed35ed0cfc883f249d8d61f9b89534fabb26ca27595c140bdb72131622aab4d5f3e12fed67eebc67a76282852e

  • SSDEEP

    96:ItlJkasxKUdSgvFKruk4Z50q1NjY2CMOt50vplejzNt:Fx5SgvFG4HtjY2omvLel

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2