Extracted

• • Target
    Para Transferi - SWIFT.exe
  • Size 997KB
  • SHA256 7a96faef83e248093584f633bdb3057dda34f1e028683d54401fba6143cf2c32
  • MD5 236aaedb72a16cae9d65454c7ed8db59
  • SHA1 f4e15e8600affc68dd028ec2d1b10dfc03f587cb
  • SHA512 d3288634de24a394965fc745d6d7efa280bdd408bb2e09f4170caba5711be1df53852ffad4f355ff6af97e6233e2f972e1469919b35f375068d16d06181b5977
  • SSDEEP 12288:ouev57kTyj+NNagXwrhZ1LwzILXUPkPI0s+X/Eu73JEvOJFi3OAPDHYkpFYMEME1:olr+NNap/1EzIL7PIhWsur
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2