Extracted

• • Target

    Purchase Order.exe

  • Size

    636KB

  • MD5

    b4998c696f853894b0c61c6554da3683

  • SHA1

    977f2760b3ab960c036fcbd45d8980e95bf54c5f

  • SHA256

    d19ccea3327e9aeb00c9fc78791c20b50a28f43cfa075485efd610b498d3f2b2

  • SHA512

    76a098ef7fccf8ab19c6e176b0001751e82224805f71ee8a2d41b9e26f0a1702c311bf6a5ff340703a6daa2c2220cb312989b6a2a684cad0cf06b44137558d09

  • SSDEEP

    12288:B4+3RUx0MSNgVkrYtW/6aRcyzi2nHdDra9o6:1Mmek0tW/6zK9DmK

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2