Extracted

• • Target

    QUOTATION_NOVQTRA071244.PDF.scr.exe

  • Size

    712KB

  • MD5

    8a03a244560c8bab2ac60b57d5346489

  • SHA1

    42a29c5a1650c22adcfa3d058ab7a8a96f5ad6ca

  • SHA256

    9ee486f00cd2636e094d7770fd2576da31d5cec8905a4c397c24417abe8c5ad1

  • SHA512

    f640e6a076a6afce220df7492e4d053fc5339350ba62b9288def37e595e43f9fcd68e8f6524aced8b6dea1797736682fb777d32c13704a2e6c90e1f2c4dcece3

  • SSDEEP

    6144:Hvxlzs8r2MF1LJqkYRyX481ah6rXrw45wQxe1FlhKO4W:Pxlg87LBeh6zDHc54W

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2