Extracted

• • Target

    HBLSTSZN11042025 MBL 149307924718_PDF.scr

  • Size

    13KB

  • MD5

    81ebacf0b5ffac8e6e37a22f64d2d029

  • SHA1

    0ce565f7581ed2ac92628609f9e558ed8615fa6a

  • SHA256

    9d27a8975f291367019591923354731db4ac8b79c283fd867c557aa49efcec47

  • SHA512

    288cc4cb52e24f012ddfae237f1c1695828672ff1961549b8b52831a4d17c010d5977def18237a206ee0de391526684c23c8aac15e0904b24343d4559dca1a64

  • SSDEEP

    384:rtzguJQ1CLj6qO6gU+CEe5RlKNY3DrvnmHFyOiV//f3ZXwSuRRImarx:p7KUj6w0ec+zrM6xXBmjE

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1