Extracted

• • Target

    ProductsList.pdf.scr.exe

  • Size

    40KB

  • MD5

    4e783011f451168c8c75229518d350a6

  • SHA1

    be7e0c5f52d8ca1ebffadf27816d4f06adcf5567

  • SHA256

    86ea9ea45a530191cb5f42b3336b00cfb92dd219f0861e5dc9dac7f5d1e48232

  • SHA512

    dd66bb38ae4117190eacb0bab5ddab5eee9b1c8c927271186ce3028d04ec4a8fe22cf68b33ff1f98179dc7a9be9187df9074276a849ef805eb94937140cc0e69

  • SSDEEP

    768:S8T7EgqeXx/Q+c3cUgTo0cNHqvRe5AmNPseYbfdleI:D/EVeXKiUgbRSNUeUleI

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2