Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    1.2MB

  • MD5

    d11c83b988df04a4c28f9d13f541e62a

  • SHA1

    a078c177c1defb15aabd2a36b13b8894cda439f2

  • SHA256

    dda40af7e530bf5744b1ae2219bcf10b8457f18c6a8ef39e9423badaf30beec4

  • SHA512

    bb4d2f2cb99e5d9331b832c54c2a8b52edfd253fe78c481aa28539053db9965ebad3c1fbf9781c1779bed6a031e01d9b2142f199d364b134d583234c92dc4f40

  • SSDEEP

    12288:mVqvrjjHby/Wuw2YJ5RH/KTuowkP4Ylib+vektHuxqilKlFL4JEgm3FyEgUiGa:1v7aYVCwkQd+xtOxxE6ENFy

  Score

  10^/10

  blustealerstormkittystealercollection

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2