Extracted

• • Target
    56516426-056C-4DBA-984B-979F68AB8D18 pdf.exe
  • Size 17KB
  • SHA256 fac95f09600baf09bf16c0c46c4eb851fe16b678f95ada7e0de25ee0bf71c85d
  • MD5 51e45a0be107e6db044816e8bf736a11
  • SHA1 88503b1ced18ba01ad5504aefc3aca68f03bca48
  • SHA512 1e88f3e70713ffd48debf95ea937dd86e9f045c6a47507f62d0c7622bf14fbe593b048f7509ef1932df598cd0f26600f423d52814af778d653fd193145723cc9
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2