Extracted

• • Target
    Halkbank_Ekstre_20230426_075819_154055.exe
  • Size 1.1MB
  • SHA256 b397cca1a04a9edb50e12c5f730cb660dff805000e6576455218dfd73a85e7f2
  • MD5 7854d68ff9e2d2e0f5ea9e277d55a806
  • SHA1 d1ba840110c2ce3f77ac28312df88b0220862478
  • SHA512 7a09687e69687c71cc0a9c72902bb7ebf884e601118176e5171f221ec641496940c8491c229e49edf873377ff02ad1eab4d67e3161f4a0e1d1a7fbd8a2f242ab
  • SSDEEP 12288:8ah/9WflU/9zElbti/HS7YEVorIZiPtRM+B8HGbnBc4ubyq:JhylUdKB8GuRvB8GbBc4uWq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2