Extracted

• • Target

    Narudžbenica 130666 Impol Tlm_pdf .scr

  • Size

    12KB

  • MD5

    8b858788092ce0a0a4c774712bf99089

  • SHA1

    d0363773fdbfa6718325af55dac0a91f0ff01a0d

  • SHA256

    511c7c20def507f2498d9bb941173990602dcbe9b45399d424c232fca3aa318e

  • SHA512

    693876604cfaf457ee3e81a507b35e8a7dbab469754140b17a2a2b68b28c5e71dc02ef3b17044d4e5a17bc2eea922c8201133ced0afc9abaa235640275d8169d

  • SSDEEP

    384:9X+ZBkUfh6g3CnMb4RHaPSqsDhVLEJ89M5niUug:96kUYG4RHcSXDhVLEJ1i2

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1