Extracted

• • Target
    ÖDEME DETAYLAR.exe
  • Size 886KB
  • SHA256 11d5f5ceb48ca7a34ddf39853c57a5128e4f5edb51b603a0ad775ed59b5024dd
  • MD5 3b4bccfc3a7fa0e2b937d071c2d2b13c
  • SHA1 94caa9c74531c317c2984b72b2319e67e9cc7415
  • SHA512 1b519dd3df6762ac0fa26a227fb26ff5d9294cb9d5a9bcd71056f668943b6fce0e775db095d399e47ec0be384a4d0ff002d5e23326c177dcbff5612933d5fa62
  • SSDEEP 12288:XfOEfW4jdEEgV82F5KXx54wME9iegQVtX:XfQqMxF5KXx54
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2