Extracted

Extracted

• • Target
    CaixaBank _ banca digital CaixaBankNow.exe
  • Size 593KB
  • SHA256 110f8f032e4b93189e7ed0b50830994114487e118d63bb8386d71e43829e8b87
  • MD5 28226d4a7aba82b48b2d6bb6a126ab6d
  • SHA1 0aec5646aeb4bfd815c41c6ffd2199a90719d3e8
  • SHA512 63e7a2f414038184015343cb22c3b2cd51e637958733f18a532d0ceaedf9319831a3bdfcab88105d7384a7165514ebc46b2f22acfdf65697cccf8088b0d2c4d9
  • SSDEEP 12288:XNj5AywFSCwbGL73HmhbEe+x230CYLVjicLkVogt2hBnYzrWG:X37KLjsb4M3q13LKt2hGr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2