Extracted

• • Target

    Request for Quote.dox.exe

  • Size

    915KB

  • MD5

    133fe057686ada7d4e07500c6fca8072

  • SHA1

    c7fcd044a6f2e1daf9ef68c500d36e49dd814dbc

  • SHA256

    0d9482728211478fca475c41feb82fc18040801f2ac7210e0bd83491ce1f39cb

  • SHA512

    e1897d719d30dcb9b70ab08eccc12d46803ba486d2718c1ceea3741f830e734e13d11bcdff4e7d4c45df74f2c34b9d557dd2370901031c055be3c57419b6bb9d

  • SSDEEP

    12288:swmi0C0e6DjNG1qR0YdgYwegIdNf7lh124bJ80rQ:Z0R/TJLf7jJ

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealerkinsingloader

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2