Extracted

• • Target

    _220926_.EXE.exe

  • Size

    204KB

  • MD5

    1a6cd2ff652a3c9c909682a62fa6e25a

  • SHA1

    54a16855a8a48f4f847a0a8ca66a2f26b333b2cd

  • SHA256

    00bcf28771526c2f876a4135520a4eb5a373f6671ea6c94eea36ce2cccbc8e43

  • SHA512

    316d788ef92ee882d39dce5f8a61b34c783b61466b6f1682f1fcf055bdc2c290990abd1a93cdf9774616d32968e23acd8dfb609d6a4b8880110a8ef4f1298385

  • SSDEEP

    3072:8I42jI06VSyw9rPdTlYpw3BC/3MYxLXVnSCLr/nEayyGq:8z7yywlPdhYqxm3H5SC

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2