Extracted

• • Target

    進口2024110501.pdf__________________________________________________________________________________________________________________________________________________________.exe

  • Size

    1.2MB

  • MD5

    f585295744e49112f89a5a780645c416

  • SHA1

    0e37e6047af775bdcc95e173980a7972595c4094

  • SHA256

    8777c299f9a823f9c959d4bf77d8e61c3e3a0967a6b8c83a10e9087998b15ffc

  • SHA512

    2993628d7950f2de5c043234ed85850685ea392c169faceebd6071bcd210e6996d58bc670bcb99de872f45c9b9f18c07737089342e7af1222d8e5ca09c72e6bd

  • SSDEEP

    12288:jQdHxoWrmhiH7niDtx+qwqzZTg9IJbpQFSk3v5OsRr4NI8Lyym5g9dorD6m8rrvl:jgSm7A1mI5pQFn3RrXAXKD63rv

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2