Extracted

• • Target

    PROFORMA FATURA pdf.exe

  • Size

    1.8MB

  • MD5

    00e8ff51aeee836ba8c765d8fddef307

  • SHA1

    fb6ebb2222b4b6a328684ac51795092435ed229e

  • SHA256

    283abbd8b30c201c0c58db11b6245ebff8fff283de873e52442e3df7e373eff1

  • SHA512

    a699858a707af7acf11d0a19896aca7ba3b5e99525566bce4620580666d7f2251a502079e95fa371862bf7d8ea616bc04c01032dcb855e085da211abc0a7b8f6

  • SSDEEP

    24576:Sxis3sVkUc0TznnsGXLDT01+EuVkwaSW+xoiOkcIM1W8M8HU1C:S33sV4MDn3XLDobuCGDodF48J

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2