Extracted

• • Target
    Garanti Swift mesajiniz 30.03.2023 pdf.exe
  • Size 611KB
  • SHA256 a169500a6f1faf4723178e5fc17ee30449727bbc5db3e7fece650a833ccdb9b1
  • MD5 d09ccbb9ce55d3b5d605abe11e410a86
  • SHA1 558cfb0ff8d8c25e4de6ca7aa27edb8843f0bbf7
  • SHA512 edf63e4946047f7663876eacf51e1765142f33784514590426d931db5f9f1443e9ba396d1c7e0d96b0b8a50c9b5f154bc3cbf09abfa2f2b24f5124bccf1f3782
  • SSDEEP 12288:jQyv5pDWPNxIy2c2Zr34bJ4LIO+R+DvmimOMt+Z5:jV50VxIJMycLOmimX4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2