Extracted

• • Target

    QUOTATION_NOVQTRA071244úPDF.scr.exe

  • Size

    413KB

  • MD5

    5b86b20e645181d38c07753dfbfbdcf5

  • SHA1

    d6d604152f9fd3f71809869f3dc461b5729a3b32

  • SHA256

    74fc05f802d4e0fb4c8d1e489d94d366b627dadf1a7063d40a587282aac04a2b

  • SHA512

    5f092badb28973eb97ab50b36881228ac350778d4a8a29a3af77f70284b61868797609783b6d1377296cd3c5384a806eec0f6444ae52a4ec80be8c19b9e0061f

  • SSDEEP

    6144:te8yEnS9z/26jJjm4ezc4PX+0y9kElwivEO45x:teUg/2CJa4kX+0y9kElw/Ocx

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2