Extracted

• • Target

    AWB & INVOICE .exe

  • Size

    889KB

  • MD5

    28a94cb3b9e0a31a27723a26177feea2

  • SHA1

    7bd0284388e520c7301bea934512a64f4dfa385f

  • SHA256

    3f3c75c07a47bb321f1c5bee8d7ab195c9e6384cf70eda9d60dcb3472b7445d2

  • SHA512

    3eb29ac71f39c2915c84316a4b0aa847975b0f07a424d294a1eabcc422fd10e3338bca5d7f46b3c7af40097192dede6b4024674c7977b4a84dc9f6463cd1b8e7

  • SSDEEP

    12288:vpMmvzBGPrCzrJx0UO0kXEEJW1AiwQgg0G+sY3yusXP9K0FcflOBRyxjMlxXOD6x:vpnz4DCBaU8EEs1AFI0KW6B+CP

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2