Extracted

• • Target

    PAGO SWIFT pdf.exe

  • Size

    869KB

  • MD5

    a1279890aeb8abe7f5f043b844c37610

  • SHA1

    f499167373d11cfd9f006e32ba493dea460876cf

  • SHA256

    ac3e59d452c9afd22e61846b9f5d1b475c0fb1e9ee0a890dea660a61280bce57

  • SHA512

    54a0b3563ccb793e1940b2b18989b39e99feee47b4f180d569ded5f8e848f70c18e0e4a1f83ac5dd3250f5852d77138ded558f5ec71e8445456002f9709d111c

  • SSDEEP

    12288:xd0N/PDnN55KQbbjQZEiAGaYwUyNLIUZBvTPEviFZEhmDL1xIrZlXXLRuAUY6IkB:r0BLnN55KQbnQEYwUsDLEIE0D

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2