Extracted

• • Target

    cuspule.exe

  • Size

    144KB

  • MD5

    cb51286b55d81634de24cdf0fa2bd358

  • SHA1

    af50caf6cc4ba374d63911031491fc846ce443db

  • SHA256

    16a775ae7240434e0563eeb9220c0fb4d2352251d4483d08d9d9678f2b743f1c

  • SHA512

    3450d5aa671164de9953f7dbfe17751619ce1bd20dd24f773d858d65e7f521e935c13da286f0a994dae91b64716339834cf8be560aad21c5a97c28a10adab47b

  • SSDEEP

    1536:fSV/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoViow8KLNH7auPyzjbuf:feZTkLfhjFSiO3omBNWuaz/m

  Score

  10^/10

  stormkittycollectionstealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2