Extracted

• • Target

    Shipping Documents.pdf.exe

  • Size

    740KB

  • MD5

    b270344e0a2760f0faacbe25670635bc

  • SHA1

    2677ed82fcc97bc63ddba361d4c0052058d263c5

  • SHA256

    f22cf9dc92fc4eee3eb35b4cdb613f21fa285d5f7630d2a898e25d4c5c512e5e

  • SHA512

    9cb8c9e211e28b9d989993fce4b93429c24f1db7a57c54a594888489568b4f42dee6c8fbadf189978d117e76bf6a85f710484892ecfb3d55ab6cffdde81cf59d

  • SSDEEP

    12288:npZsS4aTEaFP2BHykEW+7CGpfxNuWro8wFiQ4Cg0:nzsHaTEw7Jl7FpruWro8wF9g

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2