Extracted

• • Target
    sea freght quotation.exe
  • Size 651KB
  • SHA256 84bb3eef041b324e481d2f90eca48a5cd85866adfb1188405b28807bb3605398
  • MD5 008a212497b84808168738a453f25268
  • SHA1 b76183d77454f9e2b780dd133ab3f3f002cb43b9
  • SHA512 90b07946c8aa77e02fdf3fafa5ef0d624a1f7c196254c8537fa246d1d796e56f0f4556aa1e1337ce3d270da09fe5764a768e03107b2d0857d96aa61f8c12ddc0
  • SSDEEP 12288:5qBt7Zo+HOCc1JFHTaxY+/CyOdcL+tRALZeRKjIHcH9:5q7KiiXFZyOdEkReZeR3Hcd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2