Extracted

• • Target

    Swift-IMG_20221004_001.exe

  • Size

    22KB

  • MD5

    e0c62ae1f14853f48c209caaf79e8d14

  • SHA1

    c10eb3c2f9bd4725ea96850ddfc1599f747dea58

  • SHA256

    617fbed8938dd5a9348bb5bfa4d81007e910fd257e286f2b76323b95433b4ae0

  • SHA512

    06c5682006d9cf3330c7dce3beb60536794aa1c66ede77df54886bd43286f243c8a9b130ca42c74901ebbea5d9dfa50194014971c767235bec4969f2464e6b2d

  • SSDEEP

    384:TSK+X9LuPNMDo5e5Zz5TBHCZJ5H1NrOV:TSK+Ra8dFTBi3vNrOV

  Score

  10^/10

  discoveryblustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2