Extracted

• • Target

    QUOTATION_SEPQTRA071244PDF.scr.exe

  • Size

    470KB

  • MD5

    0a143997fa3893606d7bd1b09a48d92c

  • SHA1

    588a5756a6cd13650affe8e362f5909af039f5cd

  • SHA256

    e6093111d78b4ba8cf2c931afbaaf59802305eb1a0fbe9610e6d369018562a97

  • SHA512

    c81fba53628371f4b2df951f9835a5a179ee1d9f1110a3896ae56f0fd912669262c5d7b978f21bf5cd908d5c7e848eef2df7f06e2a79f57f9a4dce0c84b46952

  • SSDEEP

    3072:sp6Ip968LOS1eRWHQwwmG80XNBb7fE+OGkITo2jPbS+FN0EfYTUlYuyz:O6I/yIAWwwwmD0XabbEQTy

  Score

  10^/10

  snakekeyloggercollectioncredential_accesskeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2