Extracted

• • Target

    RFQ-43842 Teklif Gerekiyor.exe

  • Size

    919KB

  • MD5

    7c09e5b5f70f2a1b753794d6fa0df965

  • SHA1

    8626cd57ebc7821a992d583570ab785c51cf51dc

  • SHA256

    916677af442bb08e425f3e31f614e2afca12ca7d2ab51976b409bd97013b0714

  • SHA512

    6ab54e42b1336dfe04084cf56af716d722b4941af5056b82c74d795810cdb663946fead6f2e71922d575797bd80fdd987318f1f2f9396c5d29f92c373a6e6caf

  • SSDEEP

    12288:Q/LofQ97V7gh/00BeGJwvioJi9u2XyDRRS8fcH/mXtoS/n5Ji+DFj0YKAv:gtb7gh/00BWdcNy1RSwcEtoSPi+3z

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2