Extracted

• • Target

    hareketleriniz .pdf.exe

  • Size

    119KB

  • MD5

    ac17552680ce92bcdeee8d85dd23a094

  • SHA1

    3834e08df86667af59ca7ca77be8536063fb490c

  • SHA256

    5c046d79136779c5d2d1093a0ae1b45a61f4d49b0f8b8947e18bfccee2806559

  • SHA512

    0998215bf514c7aa6d0c664d78f19bbeb17686109bae943f0921d7323492bcfd796b131061a251303e970b2a60640d242555beeffec55bde2b542ad961b69dd6

  • SSDEEP

    3072:pNAUxwbSVwS03k/oej4T5zYQxwNc1xNUPBC1C:pSU2bSVwrU/oeaYQxwNc1xKk1

  Score

  10^/10

  snakekeyloggerkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2