Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    33KB

  • MD5

    d6870407aa950cb957d5953ca8f369f6

  • SHA1

    b4b01dbcd3ff4c93b5bed2caca65ae5161f8da4f

  • SHA256

    72f5582cc2f5a103307f8af4745d621c226dfb7940d33d18e8998b4ad1087373

  • SHA512

    6cd9cd4873f1c0fb4091bc4ab5b6c1f2c66490adc7fb94a763f060e9ba91b624ea175ce340fcbfd85f8ccb1f4869bd2093f02e4e210e926af28d499a7a9fdfdf

  • SSDEEP

    384:C+6mGkLVeSK3rBXnXOEGLkgt5JFV7XGddMKJKVGxovRZhYzQTBHCZJ5H1A:C+dvK3Zn+vkzzxo3TBi3vA

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2