Extracted

• • Target

    Zamwienie181WM24ZW_pdf.scr.exe

  • Size

    46KB

  • MD5

    1b3a17b5e26a738aaa141c0f82984f2d

  • SHA1

    d14b0afef232fad0ecbc49bf8f91f096f9dac15b

  • SHA256

    bb5ffa744f85e8c00110008da647ab5a10aef58d50e927f70e78f02e2ac105de

  • SHA512

    a5e1603baa309167260f7f87b76c8b369232c4666f76471e343d6a006242f374bb2a5ddc98c489d6495b4cded8b50b84706e6498c8951c45336ba66da823f930

  • SSDEEP

    768:3soeSY0ifcAfqg4mPLQKP2ZjATfUrhUzLgYmt/o/owf34LdmgWDu01L3x+1gO:3soeSYDfc/EU6K9I3mtyoEIRH6dc1gO

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2