Extracted

• • Target

    dekont_001.pdf.exe

  • Size

    74KB

  • MD5

    d998da7be623b6299e9257fcf5f80e3e

  • SHA1

    91d22e36b0aa0484136b1ee6ae17abb1f4963927

  • SHA256

    4bb7ad555a0641fd9020b58ac7fdeb4eab618214f056a489739ad6aa91f528ae

  • SHA512

    2c842a461f28225f1cb87a7a904593789f22e5a8f4a33c4b445b0c50c8e07b52b708b670b110ac006be5c997dc8d5b20bf874448abaaeb7a8f817f9f839df597

  • SSDEEP

    1536:s2bQcZBZbO8nKwK3Px4wSa43VZFnWFCH2n8yIejHBoswZDg7uj:s2bQF8CPbS71WFCW00HqswRgG

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2