Extracted

• • Target

    Comprobante transferencia.xlxs.pdf.exe

  • Size

    172KB

  • MD5

    65ae911b0aff53af557cd58a6c68be64

  • SHA1

    59f789e3d42b06fa875abfd801dbb02425e7f1f7

  • SHA256

    c35cd99a9bd4f1a8289d3bc98bf59a57ac7816ec16de668d37cf4ee747ab7c35

  • SHA512

    ab715188fb6eb7730355945763e731087f53351f7662d24befe5ebe34373cadeb7481e9a96632b236401986bac917eda235325ac9729f44385f9455b6113d493

  • SSDEEP

    3072:2KFHC+bcA0wmv5GZopfShP5yEsuTSj6deVoL+Lb4bnrzoyKOHm:jYs0wmv5yotShP5ygej6deGrfdG

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2