Extracted

• • Target

    doc 202209200099010100101.exe

  • Size

    775KB

  • MD5

    208ea4fa3dacf520513730003b3849ff

  • SHA1

    218f95bb8e3e032c6b182197df35ee55579aba67

  • SHA256

    54c419e5d402c052ca814fa728a82fdb2cfd67788960112429ef2f4734e9c866

  • SHA512

    ea5070ce837bca364be4e6f42fae5cf2e831c6486abf74e90d1de9fcb6277bdf51fb3859dcf1f97745a9a3848097219835359e16a2cd953d48212b3cf666f0ea

  • SSDEEP

    12288:Efhcgyb1Qj5eeJe194GwyU0ao1SS5GMT4h3mOvud94f2:EfPySj5eEgw9oIS5JeWqud94f2

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2