Extracted

• • Target

    903_RZ_2022 Souvenir.exe

  • Size

    958KB

  • MD5

    6b6257f6ce106df1b8bff72a80a07dd3

  • SHA1

    f0d7b6d3e9c3ffc6e8fcf09deb748f6cd0e88f0a

  • SHA256

    547e11f854149b57fd150f999595def28a46ce48d71b78dd3bf3310caeb18fdb

  • SHA512

    1498e71938066081652d52894c8c81c93a19f63dd0ef982ffc5a45cb95df5a1df026ed365d25ca073effaac134d4797c585e6802b367148793fdc0084d98f866

  • SSDEEP

    24576:/0EGAl/FZ2jn0mIRgPkQ1WkELViqPWlD:/0EflD2MUWkE1+D

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2