Extracted

• • Target
    hesaphareketi-01.exe
  • Size 445KB
  • SHA256 f4cd4df9815a2c3902f07a5389fa171f3fd6b27ae1e9af262d19d6bd286ae9cd
  • MD5 381af18f36024bf25d7586dd6ff6cb4d
  • SHA1 43f8e8b22a75f8e307c0437b71b7815f00a74b64
  • SHA512 6d15dbe47fe7a9f09ae80d63f4241426e7951ad5b8ee39049d29bb5ef69e29358f314112a220b24fbcf685b3120d42541e402e4413edcf7fb1a6e7f013fe744a
  • SSDEEP 6144:oYa6SvmeB6N7e9tzGDNbly5yrfpr1nCyAfhiwTaVRB38++6JhbC6M4lRq:oY4Dqxbly5yrxBnTe8ZRBM+lJEufq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2