Extracted

• • Target

    QUOTATION_NOVQTRA071244·PDF.scr.exe

  • Size

    183KB

  • MD5

    49a58ccea100ad0611a27e996e74fd3e

  • SHA1

    ed323734aea95ea4c69a453689e55cc7f4fc9b8f

  • SHA256

    b660914772e3ab830a6d024d2d5d09fb0568240578bdc218516bc91de57e88a2

  • SHA512

    e06b0760f82ea8e63908fcfdde8811d4de6d964338d86cfe4d73913cd39a124033ce1a17b81938afe4a218a3fbdfc050d240c60e34a706d120125710303bb1b3

  • SSDEEP

    3072:Z7kNPz56LkCzxqOL2wMCFIwg/mth9rPkA2AhEV:ZYhzgLkgMOCwMwg/mth9rPkB5

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2