Extracted

• • Target

    ZAMDOST_230-ZT-2025_Oryginał_4_pdf .exe

  • Size

    10KB

  • MD5

    fd7634082a916c3bd8c94c8493fc83e2

  • SHA1

    c60c2abf158cc15b775d147b3daeffe7ca620d66

  • SHA256

    7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d

  • SHA512

    dec560e299ed874f87271aba3c597b0ad09d7b2a7d30f2024ef16ae85f8bca3cfce631e207d23eaaf9bd22f61f916474e5e21710c2b275556a16a7549158d49d

  • SSDEEP

    192:S+SaZG1g6f0CX6I8VBoTruapz7as7wl5N+2:pSaZFyL6I8VAt7alQ

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2