Extracted

• • Target

    SKM__C20192910887888001990.pdf.exe

  • Size

    720KB

  • MD5

    0948091d10a9fdd5f17945c5216d6dc6

  • SHA1

    cdcb0c62e7a84d1d5c8fa62aa78a18fa546df48e

  • SHA256

    8ae01f38de83a0fa5f9c1dfe88fbcc594b779a8e4457bbe7ec046d541696a11a

  • SHA512

    00904155d6fd262b6297219a15d656d445cba84af12ec63aaf11c8f0b99090070d12ec5ed2a33e0457d096084ea08fa53c1d728067b6b3ab42845b0db51d1c0f

  • SSDEEP

    12288:Snp7Cef/Ycos8A7jvNU55AU9PgwMmxa689X/2EETC:wUshv28U9NMmx58xETC

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2