Extracted

• • Target
    PO NEW QT # 301122.exe
  • Size 744KB
  • SHA256 06bf0a18fa2bb4779e3c3b5efe493cc77014366ce4c54b40faac7ad7bc20e8af
  • MD5 f0b44ec19c49679b4743f977d228fe23
  • SHA1 a840e76a50d1e6a1c034c11c4eb75a5e013bb5d1
  • SHA512 42b2afde6824119a0f5fb9e01e22cc8ff5f919240370679ba08ac0ac1f4998e02a4df64dbb7254b5f02e8b0e11743c5a5092ba9bda4ee2396621ea21e34d6dd7
  • SSDEEP 12288:Hcj9HoE4y1w6IbB53o0S7Opg+19PabJEm17uFreOrbNj5Ay:HXE91Sb3BS7bERabJEm1NOX3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2