Extracted

• • Target

    a8f6bb96902e03a8e356c6bd5650a401.exe

  • Size

    670KB

  • MD5

    a8f6bb96902e03a8e356c6bd5650a401

  • SHA1

    aa68320445b3c8ba82fe34c3f2d8b8d5eb75fce6

  • SHA256

    15e2b1d8d7ec96acece7e015ec8588bec907b02945c8e20e59c1e84c039bae69

  • SHA512

    848268f6cc515fcb31078dcd29ab9c71a0ea34bb1011efc3081e5dd1a8798ba896c19efec1d5f99bfdb5cb9c25035f21930080fe2bb2bd164122d4d3791b4941

  • SSDEEP

    12288:AP6MAZf3lZSUaId9NvyotGcmby7bXV5uXNikOm76Jm52V+NUgK:Aqv6yftfZ5mik971AVXgK

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2