Extracted

• • Target

    Ziraat Bankasi Swift Mesaji..exe

  • Size

    856KB

  • MD5

    1de4377dc2bbb7a011de6b17ce656557

  • SHA1

    e68a6734dd98c3977e00458e65e32c8106f4a7d0

  • SHA256

    5975fc05d280bfb5071a38f28a7925f709f5323f609256a138d700afdd793880

  • SHA512

    70039c63732eb836de7e156958523159d00b57ad2b1498cf3c716488b932a748c433794cbfda93bbae35c63b8eab0f70bd1ed0f02202c18e1e9ec16063636a76

  • SSDEEP

    12288:QKzJrXQ9TZwe+jcQsFR0bdvFNFMotYWG62DyqHo4SN1lsQYu6X73CwkR:Xzo+jdsF6bdfFMgwDyQo48HsbTc

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealercollection

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2