Extracted

• • Target

    rQUOTATION_NOVQTRA071244__PDF.scr

  • Size

    163KB

  • MD5

    96349e5e49271d39ffcf6ec9c50ceb59

  • SHA1

    5b9953512ccbbbf7215d4141c1ded9dbdc0f70dd

  • SHA256

    5c9fc59003603b1af1ef6f29731f0c8531cef2e94103485686837d676b1f474d

  • SHA512

    6bd167d542e50e77f8d057f7ade878c0f9d1a02030090a4515a97c20ca7ecb2fbdf8f19073cde3eeea7cb3344fd2eaa96d9f0a3829bf44f3d8cebf9886f505d4

  • SSDEEP

    3072:1RzX9LAZc4Uk/172UL1gH6m+Gvq4EwOCk:1RzX9Z2daUL1gH6mPi4EwO

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2