Extracted

• • Target

    ZiraatBankasiSwiftMesaji.pdf.exe

  • Size

    1.0MB

  • MD5

    f4829ab55eb14aee2f997f438acffd76

  • SHA1

    894c189d031b0701d76ee9712cde886eff71c4c0

  • SHA256

    7b2118ed1133b43f2521509f4eac9e89b89cdfc389208099cc6e601aaf95c836

  • SHA512

    c768ab23bb9a24b69d3abe0c8ede0c3a3fe9c9a252c8c830d42e147b798cd164ed85c19dc0b96f47d41026bbdfd9d9ac1bb2c3463b23bf77338862b1a439add7

  • SSDEEP

    12288:nIFRokhnW91IeR16uEexzuuIKaonzangidJiHE3HR62Sl9dD8QNpe4S:2I+W16uZzuDozanLdkkHRNo9dAOpfS

  Score

  10^/10

  snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2