Extracted

• • Target

    Hesap.exe

  • Size

    1.2MB

  • MD5

    3eb8af973b39893de7c6f4fc5357eadf

  • SHA1

    b7cf1b022558fa58bb393ef0a527138dc20241a8

  • SHA256

    e363e0167179a654868a1baf5ee3d94b858208a070c370e44476e823560d8a7d

  • SHA512

    39c155cf04b16363691f5ae4dc529d2a1425190af39b6c8764db165b11e67f062546867eff12f75803b30aeb34a9dda5d6958504056213475d60cc02318c0829

  • SSDEEP

    24576:25EmXFtKaL4/oFe5T9yyXYfP1ijXdaCYYhzi6BTjP5Dy1cQsDRJOw:2PVt/LZeJbInQRaCY9avR27mJ

  Score

  10^/10

  snakekeyloggercollectiondiscoveryevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2