Extracted

• • Target

    Ziraat Bankasi Swift Mesaji.exe

  • Size

    1.0MB

  • MD5

    fa4883ee6ff76b2325c56b3a09502ac7

  • SHA1

    a56d1515a44a1c2c2275e5249c84d00ce3ee6005

  • SHA256

    373b6c138897ab46738f2a8eedfa6a3d83d5186f4565514e9cd789cddc880062

  • SHA512

    2bf3b6cfd91f9a524e8d86ad5329ccfe02f306bf04c2c5d6e4e135ff166e9d2d0a387ea4cae2c483113879b8a2b0d714b4bcec041a358d0511a3da7aa79c0c91

  • SSDEEP

    12288:ayRokWawn5/azb7eQw/sOgi1b8LGK79aGGbpTcIsjX:jNKvSObIfRIg

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2