Extracted

• • Target

    PRUEBA DE TRANSFERENCIA-03-10-22.xlxs(~76KB).exe

  • Size

    173KB

  • MD5

    aa62a2e500e77406ee1feabe645e3008

  • SHA1

    714fd037f44ff095e9d95c96a62525ed310ad0ce

  • SHA256

    10a21ba560b553a5dba93ade103a4d1d83c8e854b0b0ab7c0a5708b3140cecb1

  • SHA512

    bd2220aaa2757b190e2224d25de79152110f12eda824eff9ec7fcfe1c80f870a064bbd174d1daac42d04af48cdcd6c4f8b88e41f89bbcb9ee65ac2e7e468b3cf

  • SSDEEP

    3072:BQD5gQafc+zI/yjCXI7Kz0oJpQT+d5npbCYoS27uGx6BjAH2vqyy6+q:JPzdEIYfJpDd1XS6WH

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2