Extracted

• • Target

    Dotc67890990.pdf.z

  • Size

    591KB

  • MD5

    a9c7d7fc88289f358f93af9a246588c0

  • SHA1

    858867aefecbcae36cdba0b83fc6488684d5b28f

  • SHA256

    06c909630395420f8faf0e3560241c413603a2539d34683b2d5d73d72428d53e

  • SHA512

    f219b27f7cfac9f0553f5eb094cc3a120a513e5aff3b9730b37a42faaa9b3671b2c02ceb2b8f183db0a869e0f9d227fc4f85628000612a082eab2d3693b99d0e

  • SSDEEP

    12288:cnMn/KcZynYJYrRbbqyBZdAMy7BNuVUEWE5o8wUUFXma8HVhx6pShqhUWqBQn:czFYJ+RHZBbAMy7uCE7kUgaWqBQn

  Score

  1^/10
  behavioral1behavioral2

• • Target

    Dotc67890990.exe

  • Size

    1.1MB

  • MD5

    cc9b17d7e2fd4cd0150c27eb6aa57b74

  • SHA1

    3eed0a0e06be6d082e3965545ef367a7a6694d68

  • SHA256

    58cc97c8ec91ff5751fefc5eb22620f80c05b1fc81b7447d8475c67b31b4e4d2

  • SHA512

    b3d35f5cbca4865bbb839321715b5a55d4f5be39ed75a7bde8536fda4012c002c8a86c91b26b78633bc294aeb1d63a7022f384a1dbfd0fdb015fb0ac563c4bfa

  • SSDEEP

    24576:iAHnh+eWsN3skA4RV1Hom2KXMmHalntScQWro5:lh+ZkldoPK8YarS2y

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4