Extracted

• • Target

    FakturaVAT-FV2025011500091_pdf.scr.exe

  • Size

    33KB

  • MD5

    d8d7f78fe5c20a6b352f07555596d52d

  • SHA1

    87c051d95e93ede211646eedc17558d105a73161

  • SHA256

    d63c8389d2b2cabed5b7c9a96a37199ef8509f21ea4c30907ef472a81703277b

  • SHA512

    9c40cd0bc0d434dc83ad7109c7ae2760303267e2b0e04ad405ebafece908e935d315655811ac951791d268c952661a7052fe85834da928b1bc5faaba5bed2f4d

  • SSDEEP

    768:e4tstdxqNvXA5IRBy47AtXKSgWDu01L3x+1gb:e4tstdx6vA5IRBXUm6dc1gb

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2