Extracted

• • Target

    150c37f09606d999aed77f1621657847.exe

  • Size

    422KB

  • MD5

    150c37f09606d999aed77f1621657847

  • SHA1

    a75789d5c83d6b2605dc1565f9af298610c557ec

  • SHA256

    1727599b52e24b71b4dc2e5e752f653bd9160dc77d6734bd0686bae753b0e362

  • SHA512

    55143a949d24649a7520c621f97c132e1f3aaa40a943096c78b43c021a7e22ef7f424d5d0eb3b4a95f6917deb44e33198c4be047d80630bc318d7f8f42de2e86

  • SSDEEP

    12288:GENN+T5xYrllrU7QY6MGmp13LEiX5QypIUbMp6OHf:K5xolYQY65mp13LEiX5QypIUbMp6OHf

  Score

  10^/10

  blustealerstormkittycollectionevasionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2