Extracted

• • Target

    Hesaphareketi-01.exe

  • Size

    1.0MB

  • MD5

    e0f76ab7cf0e4c248e0cd12fffa4d73a

  • SHA1

    c7de7e46a575d18360f804a4116f80c5d946edeb

  • SHA256

    576fba66410ffbb712a8412d2469e68d4c6d4daa1f32604afa4c4d7ae51a2a63

  • SHA512

    e7f7fca2bb3cfc552ab70ae971c7d999a7941c4248d561717606ee8980361ffe7026948598c7e5c1a6bbd2e293eee26969c0100ddb4560ef5965654b4537693b

  • SSDEEP

    24576:7x8HnjNU3f6bI1QTBj2HwPXeJLztpOsJ/zVcuV:7OHjNMf6c1UBUJPOsJ/zSe

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2