Extracted

• • Target
    VergiOdemesi.exe
  • Size 580KB
  • SHA256 5fc74ee0611e268046704352c5e4e1562942d9c339adcbc2d71ef89948b7c804
  • MD5 d4cd3ee2d6aec6b356f2f8af2751833c
  • SHA1 981802321adf1dff2be98c70335237601508cf3e
  • SHA512 385f18f6ef7bd6049cb9fc5f0d4080d0a27c69aaa91ce909a22afb84429cc46fbad39e10833840ba7c8051505e801df61909305a085ffdb2a9ce76d5908dce6c
  • SSDEEP 12288:pNj5AyI78Z80VV1yOvVC32SEacJ7J1JgECB/:p3678Z8YfvVXtRPOE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2