Extracted

• • Target

    GuadecargadeDHL_pdf.exe

  • Size

    298KB

  • MD5

    a850decb07a489a1f6fe96ad37273cfb

  • SHA1

    d8ea2f165dab37ac9cd98433f6ea984e17e23699

  • SHA256

    eb63c71f096131d99d8d2a6ae302687adabc8f06a2527947e492acb3e7b43cd9

  • SHA512

    d6b583f7d3b3a2b0171684644cb90370b031a683bce6228b324a40160bb3f00111a46f02a5efd6e725bf451a04e93963ce8b6b783026b1d460e53f34d333ba52

  • SSDEEP

    6144:9c84OG2S2MQDtLC9xwQj2faYEEPg1zoCwo2lxqAPrAE:9Z4OG2S2MQQEQj2fad18L/jb

  Score

  10^/10

  discoverysnakekeyloggercollectioncredential_accesskeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2