General

  • Target

    FATURA HAKKINDA.exe

  • Size

    653KB

  • Sample

    240930-kj1tpsvhnq

  • MD5

    11260a37b90c317585fc3f09321d678d

  • SHA1

    41899462a11d9bf48991229ae2f50ebebd2f37a6

  • SHA256

    e1ec564734841fd72eb047c95eb767271751be018a1963000a53db2fd2355e5d

  • SHA512

    dd21bee2c34ef1d8e49035988d242b407ab75d5a80f6074397b56892dba14ebd9fc7f9e606508923cb8d8a1fd17d7583a21fd35b61eed6c58cd9c6ba2106b975

  • SSDEEP

    12288:51ZF8K4A3TGNdu1F2qoTfW1nX8/hO2meRsAbtwZmrHWMM:5y9du1F2tTO1s82meRzmZo2M

Malware Config

Targets

    • Target

      FATURA HAKKINDA.exe

    • Size

      653KB

    • MD5

      11260a37b90c317585fc3f09321d678d

    • SHA1

      41899462a11d9bf48991229ae2f50ebebd2f37a6

    • SHA256

      e1ec564734841fd72eb047c95eb767271751be018a1963000a53db2fd2355e5d

    • SHA512

      dd21bee2c34ef1d8e49035988d242b407ab75d5a80f6074397b56892dba14ebd9fc7f9e606508923cb8d8a1fd17d7583a21fd35b61eed6c58cd9c6ba2106b975

    • SSDEEP

      12288:51ZF8K4A3TGNdu1F2qoTfW1nX8/hO2meRsAbtwZmrHWMM:5y9du1F2tTO1s82meRzmZo2M

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks