Extracted

• • Target

    QTE070624.scr

  • Size

    63KB

  • MD5

    8e63d622b3d98045059d3ef8f59801ff

  • SHA1

    dc81dc1a0b0e0976c74e21a1ba14a2026dec9149

  • SHA256

    d8d9cbe722dfe8c0b15c418a13e8dd624935466783ecb271d2ed5a747abd30fe

  • SHA512

    6f66d4369e940d89d34b25e4292698df8e7e4857bb0fa723636f5f5092b144bf1a0340c5a7b731794a599c814360f0896508235add90f3c068c7aff52e612dbd

  • SSDEEP

    768:NcIzUujKOmIpfafTD4r22P8AdEEA/eDAxFVJiC9KGAZMn8clZZ+QE6J:rvjK5iyA22P8AuEAGCVJiC8GAaZbE6J

  Score

  10^/10

  discoverysnakekeyloggercollectioncredential_accesskeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2