Extracted

• • Target

    Ziraat Bankasi swift mesaji.exe

  • Size

    859KB

  • MD5

    2aef199a37a0cb73fc832ce7e26da6f3

  • SHA1

    3ced4d57eeaa6d22e2a1b247ce7ae87729e02d5d

  • SHA256

    f9e4451730239448df0b825886e85b1af1ce388697ed890e8d1d4152b09312d0

  • SHA512

    eafe6158ff2c9e26c97a64ff73b886db3a1133d56bbd02b2d3b9cefdcef68b7de573661331489d8fbbd7c83c756c42120019328c44bb0dcd09ff6d373313a10a

  • SSDEEP

    12288:lNtcDwROWJpq7bwwgNrEEGoQ1k5FQm+cQoFw2x2agCN+TiGJMTQRAFB8:hcDwRq7bLg2EG10FCcQoFjx5TN

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2