Extracted

• • Target

    hesaphareketi-01.pdf.exe

  • Size

    945KB

  • MD5

    4f0975c0be1bdd78a8a19e8744e8249c

  • SHA1

    40b30412bf586100343c2349d61f5089f76616d0

  • SHA256

    fac459fece8b8fb5fb4c6882c27b1a035b1e39f27dbd432ef0ab04ffdf6cbb11

  • SHA512

    02f3c6c8feba14342ad141a543271d1bc29cb95dff53a001d34bc339f1c52bf795671d8b0e6a379356854d2df9e496aeda605e0b2a007263aec781e636c70245

  • SSDEEP

    12288:zx/TPk2iNBdyxvDqUd1vybvlFWIOiyVyQMGOPh9w79jBngP:xDk1ZylqUHqTlFWI9mJMwZBg

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2