Extracted

Extracted

• • Target
    COMPROVANTE DE TRANSFERÊNCIA.exe
  • Size 603KB
  • SHA256 ea5ecd2fbfbc97248e315b602a26f9f9e7ec7e7705b4d536cbb2c10de76238b0
  • MD5 c7a4f00ca53bb629bd568a0e2a3b5f23
  • SHA1 6660e130cdeeedac1747eb469f4aca562b7ab415
  • SHA512 db78c6d837051624a910720156a53e054abf4f084b86c3673ac504a12ef181f4298ca7d68f671ca21104a8437ef88a47d8144b62b87701c04e684682e1e1bbab
  • SSDEEP 12288:BJPAegQVtF3K4cvmLWX/fc5z8zOSDxwbPPvaEB82oCh1CE27L+q:BJPBK9v5sNoBCT6EB8QsE23h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2