Extracted

• • Target

    RFQ____RM quotation_JPEG IMAGE.img.exe

  • Size

    34KB

  • MD5

    c3490999b5e36705b9b2abb2a3ed08c1

  • SHA1

    f6af8f800b5e86d12ea5a1a5567da493d0c816b3

  • SHA256

    8f2dd3233b7b97265bcdfc1053875652d9f9012d3716de034f73b5caadd78d7b

  • SHA512

    4e0fac9aa28dba4129e1c35ccb14a2cde1562d62f3fd920f490cc28b1c875df54911dc497c5748772dcf3f06a33f68ce9a87ebd1c7df585c05a1c952635531a8

  • SSDEEP

    768:hv2b4c1Jq7JN32aZzxya2sKE0HMN6G8jrWz0hsg4spg+:h0457JNHosn0GAvWz0uxB+

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2