Extracted

• • Target

    QUOTATION_SEPQTRA071244úPDF.scr.exe

  • Size

    1.1MB

  • MD5

    0b637b2700d31bc9bfee3d704af90762

  • SHA1

    1eb843422fe6d469060f4d9be996b32dd47eb0f6

  • SHA256

    df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9

  • SHA512

    9a14dcf7b785ed7a7176a1ff18e6f0060943229ab65061800efbbc9c9409b5cb93cd452bf95ed7efe41745bfdf4f06449cb4991bc154892e2d982da6916e4d7d

  • SSDEEP

    24576:kAnzzufFdlZl59t1VNdDPEnF6XKDAOe4H444l:kaGfFdlZl59t1VNdDPBXK+4H444l

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2