Extracted

• • Target

    Halkbank_Ekstre_003_170635_650186.pdf.exe

  • Size

    884KB

  • MD5

    a7b72a295326ac2c29592434237f445c

  • SHA1

    bcd8ffed67e7276a1799f0eba8af373cfaf39d5e

  • SHA256

    7dbd595dd8e5d4dda3c0127e8779342c42432e27ff37ac482fca8e0c8aef32a8

  • SHA512

    b06780ed1ceb88db634eb7b64db7e448fccb36f3e94bc35dff877c4d1db4692cc3e2fbad2b0be8f1e3c882d03b58d4363f770492bb24b1833823ad9961d64597

  • SSDEEP

    12288:X27t+T/R/4ve4mPyLyIS8mmKVki7vkZxB6hCHevhphU:Jt4ve4mPy+IKBVk+k7B6M+JphU

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2