Extracted

• • Target
    Request For Quotation #TH5576O_pdf.scr
  • Size 1.4MB
  • SHA256 d3fc5d2f230c3b00490e0e89f5e04aecb6e865913d2c43139a2e0ef28b03a2af
  • MD5 d54a21a69891519ea270237bec4fdc3a
  • SHA1 36731da8a00a01524a3793771fb1d67f3334fc88
  • SHA512 2cac429d2e3dd382744e8a17b613f048fe651fec500a6b1680314b9502c5906ba8d71273a67a7c07e1595d42a8b091c5e92d06b56bab4d337297014e193bfb8c
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2