Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.22405.29639.exe

  • Size

    317KB

  • MD5

    01525569bc9b96eaa3d400c27fc48e65

  • SHA1

    89ee100955aa324c06adfdae26eed42774229c37

  • SHA256

    1488d2bb17e28439602d2b7e015761b040a36cc2951f01ec2afd6a9cb4e788e7

  • SHA512

    b3f2764b612fa4dacde63eea186cb5490b437ff098f5dca61ff9b3cc93f09d74d6d2991030777a80b1c177c6fe6f24f4600ed7d39c42e5f3916480ecbf94906d

  • SSDEEP

    3072:pFbx2IW7tu1b5x/QC4czk575dVXJNEPtXYh9985AqaWZtrmOm71hEbaFSkjiRrPh:pX6tuZvxwEBO9e5AqZxa+

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2