Extracted

• • Target

    VergiOdemesi.exe

  • Size

    580KB

  • MD5

    d4cd3ee2d6aec6b356f2f8af2751833c

  • SHA1

    981802321adf1dff2be98c70335237601508cf3e

  • SHA256

    5fc74ee0611e268046704352c5e4e1562942d9c339adcbc2d71ef89948b7c804

  • SHA512

    385f18f6ef7bd6049cb9fc5f0d4080d0a27c69aaa91ce909a22afb84429cc46fbad39e10833840ba7c8051505e801df61909305a085ffdb2a9ce76d5908dce6c

  • SSDEEP

    12288:pNj5AyI78Z80VV1yOvVC32SEacJ7J1JgECB/:p3678Z8YfvVXtRPOE

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2