Extracted

• • Target

    SKM_36722091313070_0002_ 001.exe

  • Size

    788KB

  • MD5

    d58c21e4f1ab72dd6ab41ebcd6323018

  • SHA1

    a3a3a195660e27240a7534e27221ba4335659c22

  • SHA256

    c28daa1ae82a06070c34aa4380f4a8a29a5d9df77b2a8cbd339b765f3d5ac653

  • SHA512

    6a82a569f53d325a43e8d9d705bca7cda51c62ae55e841df42a67d395fb017d22caa05559b8bd75164c41802ad202157fbfab8444ed28943f93f21cd0df7aca1

  • SSDEEP

    6144:tYmWfih0m+3no6/PNLftxEt4q6GUrKk0KSX4+//SZ55986n73a0PPRroRI+mHw2E:tJYWGqHUp0DL/6ZG+DoR7mQYQHwKiEj

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2