General
-
Target
Hesaphareketi-01.exe
-
Size
515KB
-
Sample
231030-ljrfpscb5w
-
MD5
bddc2a8284bfefe392c2552b25f3e0e8
-
SHA1
8ee6a96a7bdde302d92a3ae7d8ccec53c8523745
-
SHA256
861560fab6adef6b87a9ca272f91f8979bc28e85f120a390dadad92bccf77996
-
SHA512
a5d6feb77a75976504157e3fce7e5c11e46070d5edfa57e1dc1415baceda7846bad93960beead32fe61359517eb3a9f45544595f41d9563a2f370f9c4196ed9c
-
SSDEEP
12288:D8Q69yqLAaJSpkRNAaa8zhZ02UOvKi/f0xaL/+VPdy:X6XshkQaa8zYOyi/f0xtVPdy
Static task
static1
Behavioral task
behavioral1
Sample
Hesaphareketi-01.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Hesaphareketi-01.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.defalife.com.tr - Port:
587 - Username:
[email protected] - Password:
Defalife124578 - Email To:
[email protected]
Targets
-
-
Target
Hesaphareketi-01.exe
-
Size
515KB
-
MD5
bddc2a8284bfefe392c2552b25f3e0e8
-
SHA1
8ee6a96a7bdde302d92a3ae7d8ccec53c8523745
-
SHA256
861560fab6adef6b87a9ca272f91f8979bc28e85f120a390dadad92bccf77996
-
SHA512
a5d6feb77a75976504157e3fce7e5c11e46070d5edfa57e1dc1415baceda7846bad93960beead32fe61359517eb3a9f45544595f41d9563a2f370f9c4196ed9c
-
SSDEEP
12288:D8Q69yqLAaJSpkRNAaa8zhZ02UOvKi/f0xaL/+VPdy:X6XshkQaa8zYOyi/f0xtVPdy
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-