Extracted

• • Target

    FACTURA PROFORMA pdf.exe

  • Size

    826KB

  • MD5

    708b864fcebfe235752eeb2c5ccff0c8

  • SHA1

    61295aeeb9d0fca8d778d85878d4ba3ec927b354

  • SHA256

    6a2167c7c8ec6a6101465cb228421143cf18abf246a898cbdc6026b9824f205f

  • SHA512

    9f9f2138d9978228164e93e19b09bc79aa306d282d3abcac5d85430e4551c6e3e78b2ab6e0a9feae7c451076e71c34d2dcc60650345ff79b44fa52cba88bd824

  • SSDEEP

    12288:xBHINMAgeY0uLVgtXYIEv1G7QTlLLfUZEp08aJE231XW9xc645v:bHEMpoupaXYmQhffKEy9OK1Uw5v

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2