Extracted

• • Target

    FT_AR_91007176_1.3.1.601_8042025_PDF.scr

  • Size

    13KB

  • MD5

    8f89c61f800c1785b53504906d7ab213

  • SHA1

    682b5b07598f566c8a83d1cd629ecc28a35956da

  • SHA256

    3f03f6212ce48527322d5eeb85ce582abac11a662a7439722e53bfe6a8ad608c

  • SHA512

    8542ddaca5ee7dadf21ff5be70e3a1c5bfc980a0bd98c88babd242428131cac745fa5768dfdfa62266734ece2b27f71b1f4de6428359fdd5cc6896bdd3c98ae8

  • SSDEEP

    384:YNodJ716gLCiYT8NY3DrvnmHFyOiV//f3ZXwSuRRImqv:YU70xT8+zrM6xXBmjqv

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1