Extracted

• • Target

    Shipping Documents_pdf.exe

  • Size

    954KB

  • MD5

    f21a5f9b0b58c725e506335696db8451

  • SHA1

    8fcec3ef43597131fdbe8a97ba75356190c9cdf7

  • SHA256

    780ed56e397c2e5dcd786e85261ef0549bc29c715971933aba06c10bc7881128

  • SHA512

    3c9b57ceb150a944212ed80c5e743241760f955190f4792f06867d2909f75bc8627a0c94cac5f060247003af8ad30acff5367f618016c2819650fe549e36878d

  • SSDEEP

    12288:+tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaA7vt1aoTrWPRb/xk6A:+tb20pkaCqT5TBWgNQ7aA11+B/xk6A

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2