Extracted

Extracted

• • Target

    VBGV76.exe

  • Size

    153KB

  • MD5

    131918d781ea54849c1b303c9761cdda

  • SHA1

    08ccefda3873d5b6c37c463cf7405922f54a345c

  • SHA256

    769294c8432281947d6123baee322d195bd0a8a88c89fce1aca8762dc1ec3e73

  • SHA512

    31e2041ce40d1cf33cbaf61d043d11d1be82e0a28b3e043cf63bb950ffa6be6bef1b5e50eed41ac0f3459613f3e56fbf7a12a6fa227e04544571cca5272e55b0

  • SSDEEP

    3072:DlLM0l+Q/znsDUnAANPDB9h/WyERzj25q+kbj6LuT2CfUpvZInr3tSEvJrUkNWMN:Dl40X/L5NPDF6R+5q+kbjMu6CfUtZIrD

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2