Extracted

• • Target

    ZAMDOST_230-ZT-2025_Oryginał_4_pdf .exe

  • Size

    10KB

  • MD5

    0dcd8fec15008f65cf8e9bb63d1b9e8f

  • SHA1

    0971537d92bea47b1a362c043b86e72c0e409ddc

  • SHA256

    2aaec088fcb6aad10489c469a1808dade264b9b19f0654fc82a37ec9af36b266

  • SHA512

    8bac17357f5a2b0273d226ae3e193ab1473bc078b04b3a62077c61908827509aefbeea89bff7672cce9094ac17725335bb5f3f9b9bdb0f399530956bb0fb4271

  • SSDEEP

    96:wdSSh0JE5Ooo7SSLLLXtyUruatvzrUUR1I7HMkExzF7MjJ5NX6MzNt:wSJE5Ot7jLPXrruapz7as7wl5NK2

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2