Extracted

• • Target

    MV GOLDEN SCHULTE Details.exe

  • Size

    543KB

  • MD5

    c4666b037f3fc1f7682bbb525477ec57

  • SHA1

    94258a03c3ebfa3c62621c2cfa2275ea493e908a

  • SHA256

    0e28edd49df1a28f394bd5929bf06d04418c9365980bdd56a68d058ee56f52a3

  • SHA512

    59f7509afa4f58f2f3a448ce5ed29ee93c33bcbec9018d0a4059425f417bda2fd496326a28e25d1626716ac9b3a38ddd33932975993a8264d64b04b13268ca79

  • SSDEEP

    12288:cDEj8OogHnvxKMIhyEk62TQyouF/JUKio3:18lqvx9QlJNW6Kd

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2