Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    1.2MB

  • MD5

    8b0616913d8e951d44f1df7403b14ba4

  • SHA1

    99dcca8abee4a346e86cb3091af315e951d0da36

  • SHA256

    9fedf1aaea38b9847b0badbd1a47756ad0c48b541460530e1602485ef707ae0c

  • SHA512

    038675388446c9068beef387b0630f6e57d6ef9df5d2f145c78fabc41743608d574639d75f38faf010cf82b9a3e25e490a93e0b641ad537ae9f2b89225ea65a4

  • SSDEEP

    6144:qQEnLie8O3JkyEPtCS/0imMPIAcaei7z4XYm/phOfJI5+GRSTneGRpr0wQGCztNv:qNie8EOyEP3/dAADrziYmxR5bdwDkNv

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2