Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.14959.exe

  • Size

    743KB

  • MD5

    9700401bc6c92451ec9a185a7a042cbd

  • SHA1

    f666e7947886353448e6d09798f36f1979a1cd91

  • SHA256

    97dd5625186d8b272fcffd07098106fdebc7792a18a019cb310ff81f0d7e0a21

  • SHA512

    27c51fb4cfca469c84429f3f0f45e7252a6e6f139318645bcea8ac245607beab0c3d5c645f969bd68fc29d2a7f2449c393a9769c88671d946ff6ca3d62c776ed

  • SSDEEP

    12288:uQuq/PQ5IWui9CZzPKFgBGq0vAf2xyttXNsRb06N3L9LG:RCxui9CZzPKFc7UAdqRb33L9L

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2