snakekeylogger | 7cfa2679df6bf8e6bfbdecf66e8f94b4ead43ea1eff4db042cc3300e2acfec2f

General

Target

7cfa2679df6bf8e6bfbdecf66e8f94b4ead43ea1eff4db042cc3300e2acfec2f
Size

506KB
Sample

241014-npy4vayfkj
MD5

3797cf46d445949e404cff753a446a7d
SHA1

c3f61a7bc8c67fdfeedf50aacc8d27152c4dcbce
SHA256

7cfa2679df6bf8e6bfbdecf66e8f94b4ead43ea1eff4db042cc3300e2acfec2f
SHA512

97a47abbed27ba5c65e330aa326fe33d8fcbb377accfadcbf8b2d6d4729263f25118c2b463a02e7e29c0199faca15842be40b6de807eeafeb21826a57c3fe36f
SSDEEP

12288:KlT0MbdctvcEXScU60blqskSXpDE3luP8C7:KlTTWt7icU60B1HXpDOuj

Score

10^/10

Malware Config

Targets

- Target
  
  HESAP DETAYLARI.pdf.exe
- Size
  
  598KB
- MD5
  
  b040e5d5e8022359da5c465ad3e2dcf1
- SHA1
  
  f6f7f65784a00c22c478ef578c7b47c716997a60
- SHA256
  
  38e3fa1e0a5550df5117b64b4971d6d7ce187519d26e5d87abe7b8f949de3f10
- SHA512
  
  86d700f48a88153ce075688c671667be905f5f0343e8b7b95c56d8292fb7536e1c1cb36788650dfca174489ccd7ce3f5a2d5cdd67b3cb093f6d5bb69447a41cf
- SSDEEP
  
  12288:Ncir1S2IoOAc6/5rZGmy45nZZno/59/qVcVApPstz2ug/K7bNcKTwwxp6H2dOWqp:JnZ9oqcapEtz2Z/K7b+awwa2db0
Score

10^/10

snakekeylogger collection discovery execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2