Extracted

• • Target

    QUOTATION_NOVQTRA071244·PDF.scr

  • Size

    73KB

  • MD5

    3518e621e9ac0f5c9de6e3c3921c1365

  • SHA1

    78582a73cc154ff3415225f57d9ca615c02b80a1

  • SHA256

    7d79f16250f4c090d466be4ee8d4df679b489313ef5cb01e3528b71f64b9d3e8

  • SHA512

    e1eb1a1def9805a2eee3c1cdd20a040c351643115c0642be8ef3b767f4c0952ddac312382730841eda4e72bd4691d03d9c7567e1032d30abd7448ccfb677b7de

  • SSDEEP

    768:MhpjDqQflLNiasAnRYizE7fYd54DPzdpK5wzJUbtE9m+g4/lZX/f8a0MKG06EgRy:aNzialHII4fd7qb+g4/lZ+MKG06EYre

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2