Extracted

• • Target

    QUOTATION_NOVQTRA071244úPDF.scr

  • Size

    1.2MB

  • MD5

    9cb11cf0e358d8b07765cb9b3830ec84

  • SHA1

    934d2ff4aae74a15c211bfbec2d912a0b6da130a

  • SHA256

    259768c3fda8c71024d9e77d8ebf98ac72b5dfd672cf1d93161c724ea256e83a

  • SHA512

    ff53714e9dc388b0f75c0d10a6038bdd7ff7577c2564976d8b2a421f8d18ecbf87814457ee4d3f8e88921af80327380b0524d1285d78346ff38f98c32acb412e

  • SSDEEP

    24576:7zfPC682UBvyVFA3rx+ppyDW8XxgGzfi6F3DY:HbQtxQaxfi6F3E

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2