Extracted

• • Target
    12220173387_20221124_13363111_Hesap0zeti.exe
  • Size 1.1MB
  • SHA256 3987c7ba08298c6fc3d6007468e751b3b751e750ea3a0ae5b2c5e699bac97002
  • MD5 603fe249c0d10719a8d2fe5985e85d51
  • SHA1 f28fee2fea1ff815d079feb176daadd5fe00c28c
  • SHA512 e7aba6186de2956448b8d52d75e7d6b9cb98cb78c5de14b694243c7f02a4055c481e4079843018a6ba5410aa145ad0f48b86b36f725ee22aad174079089ef5dd
  • SSDEEP 12288:krmZJbxpDFw37lLnJK80DMx+XYRiVMaCSwMZ5cVz82UZmapTE6BmcoNbjSC:krt9KZDMx+IA2erHi8TpTic1C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2