Extracted

• • Target

    Request for Quotation.exe

  • Size

    1.5MB

  • MD5

    3a94a458ab6aa725826bb99bbb60f198

  • SHA1

    aa761d0d9095449da2cf01dc535f44ab4b32f03b

  • SHA256

    19ed2682196c62c35dfae288464bc621e251a6a3237216916479a8fcd06efa19

  • SHA512

    70c1bebdd905711b9dad51bd050ab4acb4a7d524f0d903fd62f2a2ff273bc57226e696e8f53e3efa9b620795d50052f0ab6ed1483a205aea7c8f11b2e6984d2c

  • SSDEEP

    49152:7P0wUfbkbga0csbL0rqkkhM18j2FLlxyWFW:wwUZr0rqkkq9W

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2