Extracted

• • Target

    FA_35_01_2025_STA_Wzór_standard_pdf .scr.exe

  • Size

    70KB

  • MD5

    c264894ed58fdb81e565236476bfe7ca

  • SHA1

    9f64388e03f8162ecca1ec6620b52b1a586ea369

  • SHA256

    6b5d2ed235ccf7757a7144116baf1376abfd13b7fa5d87d130db3af889c72a51

  • SHA512

    4f2ad5466c7da243758b9900de3e0897b04299622aa23adaf5be92f3dc1ac9b3ddd06d2fd5b36ca37d884fe17ae49d608cc407b782e89b1eda7d215c9358bee1

  • SSDEEP

    1536:Z88lDhBttnpa7DvJ6/Vx7Si40gCs3CWpQ1QKqWI6Oac:BJ33nSDvJqVWLCjWpLKjIOc

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2