Extracted

Extracted

• • Target

    Hesaphareketi-01.exe

  • Size

    580KB

  • MD5

    77175495f7c07290890b5005225c074d

  • SHA1

    dcc345a4ba956e493eeda89a087f4e3ae50dc7b8

  • SHA256

    314f5681178079a783379f4b04ab87b33e8ea82edee4707886a977bd19cd8b82

  • SHA512

    703277b24b59a1742f5d9d2fcd6beccf155aa4adc04d3a2405a40792576dfb53cd01ec96818b081418619768cf4701c4d651a647a8ca018988ff10883c1c3709

  • SSDEEP

    12288:nb5yzvbYmBH0eAM7EasmTtEGb/cd+2oYCYCclYa7mPGyHa2:FebY09AMRsOERnoTYzlYa7Ua

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2