Extracted

• • Target

    Faktura VAT-FV2025011500091._pdf .scr.exe

  • Size

    403KB

  • MD5

    d1ce79b1ed07c976f65e3f715eebb42d

  • SHA1

    86fd4ef7598e6795379361a3bc931a6fa446cd4b

  • SHA256

    b0da8ee7ba9f7867231c71a57402f66ee0a42b89fb130768a680cd0f5c6bbfe7

  • SHA512

    51e49160cc915cad92a260bf58ecb7997890336d4402334952069d975cd9ceba17eee7e4e88d99459d81f45d03291c930aad0cd3a65bbe3c65f6e05ba63885c9

  • SSDEEP

    6144:8TErM9in42rv0JkLKpmNG4IST9K+WGCIe8zpDmStL0qGV0lT+BU/rHFV1euZbIus:N94284IS8RODRXkupCuqtaZd

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2