Extracted

• • Target

    SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe

  • Size

    83KB

  • MD5

    437cdc9cd5aa816864a2d1f6ec30d23c

  • SHA1

    23b7a7c73604cd3ad97ca77062f6fc1c8be67376

  • SHA256

    bfa82ccb728c0ba5533bfc1093487edb9d06ab10080b915c64b759ca86b0d9f5

  • SHA512

    9639697764ea464f5617d809bd6883bcc7e71349082665d41e80a63f23c5cb8a1a0d7d74019a33434bf32391b2f365778203a11102b83a8beb1a10586610b450

  • SSDEEP

    1536:+QWI/CRcoIpDJM7ojtOTNH7zpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLr4uixPCb:xWIo4DJM7ojtOTNH7zpga/eHUTQQQQQ4

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2