Extracted

• • Target

    PR # 3000005991 - Quotation Required.exe

  • Size

    1.0MB

  • MD5

    a367a9d548befb868f0c6aac5bc49c3c

  • SHA1

    0349361a3222207197f30ea67de2560b49531d69

  • SHA256

    e71b1065a4b1b0fc1174cecf0963797fd2cb8a0dc4d0b5e7166ecc8722071bee

  • SHA512

    15ef7d731b1e499c0289c255596908c205abdcc5b754ec4c185235780ab99b5072e94b3db8eb65dfa2127108643f51572413856e989b1200218595b8685a7e18

  • SSDEEP

    24576:3AHnh+eWsN3skA4RV1Hom2KXMmHaYogZrz5:qh+ZkldoPK8YaYom

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2