Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    1.0MB

  • MD5

    dac6ff7df0241efb2589b32571be8e94

  • SHA1

    93e6e1c5f82cdc6a9409ee87f39765901bcfd928

  • SHA256

    6c4be9cdd9d41b20723760162496bb68b87ffe487d806a8e0df60d000f91625c

  • SHA512

    5bc65a4f1678e2b131c00a150c307bc048f5792ae13064909e601853ff522772da58b40fe94ef0fa185e31726c16bff55f53bafa27a3592011fc4a0126753f43

  • SSDEEP

    24576:Su6J33O0c+JY5UZ+XC0kGso6FaOETuBjTvxWY:Uu0c++OCvkGs9FaEBjQY

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1