Extracted

• • Target
    Invoice No 2023-27-04 037 for prepayment of 100 MT.exe
  • Size 917KB
  • SHA256 e5576bd4af80125cef4bbaf71b357486fde975fce56ff17c782644933d542828
  • MD5 cf2cc7de7ba72dda126ef4b4c23f4a17
  • SHA1 91eb4410dc1d491ca24ade6e823327b01bf3d4d9
  • SHA512 1d9b05913975857e1d33482d51fa071df99688e4804495bc3a88020e99d4a57b49c4632eeec10657b0aa5145a58a91edb4887965740f26e539e9151bd906c932
  • SSDEEP 6144:lsVpZCRorNdxRdMhnRnK0kkMM00nDvkGRvsQNeaJgqYklScMIMqsgq/lwpU3Y9cI:u7KdKrWDv9NobqY6Kl29nIBEAw155
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2