Extracted

• • Target

    QUOTATIONSEPQTRA071244PDF.scr.exe

  • Size

    368KB

  • MD5

    51f72822ddf3ea7523d116ff4328c22f

  • SHA1

    70e22a50a272f9cecac73153e812fa9d140edd4d

  • SHA256

    5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9

  • SHA512

    9bc35c63f3fbf48d362d7132925d27880333a13e2cdc2b0cbd9f1040475b410701aa1791504f92559622f44d99ab5cd3ece37ec7b8682685fc86e69b0937540b

  • SSDEEP

    384:OJGY/HAGNn06CjFN8P3YsU6fCWYA8S/hs/E2sofOh/Q0RbnqRGt/KzVtBBU:OJVdNdM8sScR9ApqcAg

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2