Extracted

• • Target

    QUOTATION_NOVQTRA071244úPDF.scr.exe

  • Size

    412KB

  • MD5

    5603b0efc985ba44c0e4babed8e5e964

  • SHA1

    44fdca0b810dcf0b06e8a5d8cc20b47323048128

  • SHA256

    e1eaf901b41bfdc10adce756822f36f7ad94df652d27a86e935d258f9b43a7bd

  • SHA512

    6f16d66409f394ef35ab802f896594652ac5936d6fac1dccb9b708fb2f1e21996a4840eebf6040cacebf94e41ea8d06ecbc5b9b16381c766d602641f53690c77

  • SSDEEP

    6144:3tBwxB91YOelFTm6ZjVTc17izGdlwwHqg7UjTduOD6s:3tBeD1FelFS6ZJWiz8fF7UjTdJD6

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2