Extracted

• • Target

    41570002689_20220922_05393480_HesapOzeti.exe

  • Size

    868KB

  • MD5

    da1eb258ebce6a56bb005da137e7ad39

  • SHA1

    e7a80eac4bcc6fbc8e7781d0f62d6807edbf3baf

  • SHA256

    cd38bbc0668699fe1761de97d8dd736321a219e5cf99767bb1f0dd81a2c03bcc

  • SHA512

    93b6eda6f657df02208bda1e5980b1de35afea6e5f11a16fb0b621868b6bcd8d6bda04625c6f352f6935d85962458c3c2cbb2fa10f25be977eafcb6f2ab1d814

  • SSDEEP

    12288:klDZQS57JF2fvAcxD9E0QaBNj6iumhTh9GwKuCpcVz+RfwWbjvNYugmv9uE6kfYy:aZt7v2fvdbhBNjthT6WJVQLjz

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2