Extracted

• • Target

    150 adet iKMiB-İstanbul siparişi.exe

  • Size

    816KB

  • MD5

    199618b5fb4cce3992ee9c29885e8207

  • SHA1

    3360fbe47c82290b6dca52895e6b7ecb456e74bc

  • SHA256

    077c6dc697fe099f49f24e345aa6dff6ede9be899e28906f856111b5ce364b14

  • SHA512

    5e6c9a42302d232aed6787bc6dba1c1d1c3919c004e3cc3072696caca10b39a03f79dd1dd9526caaf10a2996ea66111254efe4e0800f573e74019ce5adbe48e5

  • SSDEEP

    24576:qK3rbKyIHJaK2QP/Do01q+h+i05rYDgaCuGxN:x3rbKjEGPZqi+rCgaCuK

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2