Extracted

Extracted

• • Target
    cd2fe8087ba823ff3f03248e91304abc.exe
  • Size 524KB
  • SHA256 bb29bd98dc2e9ea502e1e473b659e56940e604cd87058071b08a95dc7eddf7ee
  • MD5 cd2fe8087ba823ff3f03248e91304abc
  • SHA1 0d35f13e05751f72375f371ec715016a41270fb3
  • SHA512 3d68efb0503b75f68ed3d944734b1c134943c25496602700a0791f3c2c9a2db00cfd59d848e2ddcca145e3f284534ae3f4c896d3e5c37e1a9389989c9cd01ae6
  • SSDEEP 12288:gLfJYkvnuruXZT/KO8XgrJ8SQjK7tCsdM0aZuUYkI5Kq:gLfikvu6n8uHtnrUhI5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2