Extracted

• • Target
    53060033570_20230519_08055750_HesapOzeti.exe
  • Size 566KB
  • SHA256 5ddb8e1199d3dfd3ab099e813a7650e692a243dba79e9eeda5def71ca4d5d0be
  • MD5 fd4a5e5d5214e9fd96494157a1fdf896
  • SHA1 4d68d34c330a1b08c51f5b28d4d945bd2de64c18
  • SHA512 043dba3fd7bde7be491cbd1985df93e8854f0cad39e9f529f27b85c32c3300d9657a8a77cfd8102fc96bd31842f1ead084f6792bd635e4c33e9fcb5bc4256865
  • SSDEEP 12288:ruPni8lTDAOZXIIIGznLxklo/31cNXcBIqJWr6lQxDG15:KdlfxIgNklY2cBzWr6GRo5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2