Extracted

• • Target

    Invoice#2002668_pdf .scr.exe

  • Size

    374KB

  • MD5

    cf48f8e673aea5fec287be972fe41bd9

  • SHA1

    e0c4988c4726f6a8267484389e94e77d5dcb68dc

  • SHA256

    03c05594de8443bee3f59e7d905ead514721464c3388584975cb5217af2afcbf

  • SHA512

    a5f18f0e3ab0b438127dc42540bc6c4b53e55cedf7ba81610c62e99dfaa40f2869f97f2a1d8238a0447bac32d8cbe518dcb2cfd2fbc8d16b35aeca10d8341312

  • SSDEEP

    6144:oRSqYzjhWnqRxS5xtUTH15PGFSSOdxtnON+ANZj9NOnm5xxxx:JzjhAqRyxwZ3MNOnm

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2