Extracted

• • Target

    12220173387_20220825_13363111_Hesap0zeti.exe

  • Size

    1.1MB

  • MD5

    8c0c9c9ce087cdab90db2db5cd29a194

  • SHA1

    eb3436fd076e2854b1d5d6957ed32d907bd03d9c

  • SHA256

    03d111de04e5af8d0a126034372cc928d8e3ac78ff8e81a0972a35c5eeddce34

  • SHA512

    324eb5f28dfae912bd7a5b49a6aabeee3ed34d0a5765efca428554c6792e5a33d6d03cb969360ae01671c48c6c9b2a85af51f4ab736a1b3b7d4a027936b15a3d

  • SSDEEP

    12288:Ce2L7HCkEYKfg9MTmmshNN5uhJ6+JQIUbr22TBEFlptV5FU778Z:D2fHCNc9g7sDNa6+JQIEr0tV5O3

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2