Extracted

• • Target

    Hesap hareketleriniz pdf.exe

  • Size

    1.1MB

  • MD5

    79ed528abfa1bbea14e37e46618c8c62

  • SHA1

    8c873717c85fc9e94b1b26194d5fb6c20f20de86

  • SHA256

    6bce5b711926f8dcbec9c90407e6ad9e77761acf87bce8c548f065cfd46a503a

  • SHA512

    3f57ff9a7ab58f8b66b18461b989dc0945f49fa472af8abdd3ba892a761db242ac3b3c5b2de0d7e67587306b53d9c11591d7fc8be6d031b39bc2304a0615e4b7

  • SSDEEP

    24576:eE2Lq/a/MhtGOSaxqX6rrGY6ebr3UIb/S3N+t8Y014ux0:Ri/2QUAA/sma3NW64W0

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1