Extracted

• • Target
    General Attachment.exe
  • Size 744KB
  • SHA256 bf15bf7ad5e678a40cca28a50fbe8a4f4aa8b86f3480820d8c0178db3107cb15
  • MD5 b005a335c5d12794db00dc96955c4e49
  • SHA1 370cb2eacb3480b36dfea50b46537451e535e30a
  • SHA512 f94159530cf6ccdd7626db0de40db3a3b49d65620b81b356c3c4fe9f84e9018f0356f4217bf463516af03abc2fb036690730012d4e5e99b7e416562df40439be
  • SSDEEP 12288:vBvwiX0xPmaJdZBsQdSwxT+PYv7Srr/GtZGCGxqvKuJ7yp0v0RF/f:vZF0xuaJdZ6QdSaT+QvQU1GMv6p40RF/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2