Extracted

• • Target

    hesaphareketi-01.PDF.exe

  • Size

    531KB

  • MD5

    5b31501232583da35ea20ab826cef71c

  • SHA1

    33f1c8bc3af1f99f919f9451f19c0539f3a452ea

  • SHA256

    4ab6d78c4846a801d11c6263585e0154d8e610fcdaeb123ef91c819cc7c76cd4

  • SHA512

    9c35d03400d2e8bccfa158f066d378e9b3befae46c68164f7e69a15690e5434cfd6eefb6462415a2bbb7d374e3c529ba618de66d7f14302af8f4976ae7a9e10e

  • SSDEEP

    12288:PDXrEhB3zhZQ1FJeIYgCvZmQSIJI6nYJ6k3:PCB3zhZaeBpvVNGNE

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2