snakekeylogger | 3badbaff81cbfede25404376a04a6a1504ac3148bc2bfdfd6e6bf441b2a40373 | Triage

Submit
Reports

Overview

overview

Static

static

5

Halkbank E...df.exe

windows10-2004-x64

Sharing

General

Target

Halkbank Ekstresi.pdf.exe
Size

1021KB
Sample

250410-wtvwzsyzf1
MD5

46105f278f88316cb3a1f602732a29ec
SHA1

840332cc7cd500f908c2c30cb1a895989c5ca2bb
SHA256

3badbaff81cbfede25404376a04a6a1504ac3148bc2bfdfd6e6bf441b2a40373
SHA512

72d65134807a89d286dcfbb4d74e43889906ff5c0f749847a6e753ede5e4f8a509f6740a71fafe48bfb0bb29724c4dbf3dc5178d06a46e5643cdc68e3b244e0e
SSDEEP

24576:Yu6J33O0c+JY5UZ+XC0kGso6FaJETuWKLNXWY:Su0c++OCvkGs9Fa3WKcY

Score

10^/10

snakekeylogger collection discovery keylogger stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Halkbank Ekstresi.pdf.exe

Resource

win10v2004-20250313-en

snakekeylogger collection discovery keylogger stealer

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.argeotomasyon.com.tr
Port:
587
Username:
muhasebe@argeotomasyon.com.tr
Password:
P@ss135246m
Email To:
simth_jone@yahoo.com

Targets

- Target
  
  Halkbank Ekstresi.pdf.exe
- Size
  
  1021KB
- MD5
  
  46105f278f88316cb3a1f602732a29ec
- SHA1
  
  840332cc7cd500f908c2c30cb1a895989c5ca2bb
- SHA256
  
  3badbaff81cbfede25404376a04a6a1504ac3148bc2bfdfd6e6bf441b2a40373
- SHA512
  
  72d65134807a89d286dcfbb4d74e43889906ff5c0f749847a6e753ede5e4f8a509f6740a71fafe48bfb0bb29724c4dbf3dc5178d06a46e5643cdc68e3b244e0e
- SSDEEP
  
  24576:Yu6J33O0c+JY5UZ+XC0kGso6FaJETuWKLNXWY:Su0c++OCvkGs9Fa3WKcY
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

snakekeyloggercollectiondiscoverykeyloggerstealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.