Extracted

• • Target

    Halkbank,doc.exe

  • Size

    944KB

  • MD5

    895140d717ad9ea92e1fdf27d9a8faab

  • SHA1

    1915a1c454d26d827e72c1f2edd242e66261f495

  • SHA256

    3cca31e08e5e7460380b7547f77a67485cb559c5b1982894c7e739031be97920

  • SHA512

    242214e9b8dcb1e70cc7797c3670e44a49084289cc684131b856e3b0f9995b47ff84e64c5a9d4453aede376ee06b3d33573e4e3d3f7cde5a3ff3668e9483c2ca

  • SSDEEP

    12288:MFzTTDV7uikFgUWYaM47dS7gWe8JX70AJ4LcGWmZVLFzNEMMYzJI0xks:MF/TDlubgUOl7dS7gowpr9XxZBJJx

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2