Extracted

• • Target

    VESSEL DETAILS.exe

  • Size

    572KB

  • MD5

    856b492b5456b166d2a4d1bcb77e841c

  • SHA1

    b199b0869236ec28ffc68580d4ba3e2a010524af

  • SHA256

    9107f64250adc3683e50d7fca6b41e9f7875136ef7d78200b5756e154e0c2602

  • SHA512

    afb0a2f25a64cdcf121d7aed0f4fb92b76ac6e64e1cfa18e8d4784e35a2c1586f430adde53e31980ce1ff91ffdf8a58512e82f6f94590cbea8c194a818e8ee06

  • SSDEEP

    12288:nGnATF7F6LFiCprQ1wB+l2pT6wzVp/QLStIpsL603:nGnATdF6ZB5Q1wB+4Hr/FtDu0

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2