Extracted

• • Target

    rfq#09234a.exe

  • Size

    800KB

  • MD5

    20397f2a5286e87f72a2b39edf048a89

  • SHA1

    cdc0de28872b5fa612d6ef931465466b626d09b4

  • SHA256

    e95541bc5dd30416ce2189fb79666814d4f236fdc67ab4dc3d69fd44c7e3a259

  • SHA512

    b083acdb4806a6794eae2bdf6e9fe9a5538d4e7656cfe2163cc94c854ddee939cb46a417311d93757fd1ad991f408752f1e2c3ca6e4830944ca750d3c97287e2

  • SSDEEP

    12288:Lzx1WrUdHL+NMvHRMieFKSb+oRo84x4GVP7ngG:XOgdiNGV7SbxpQ4GPL

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2