Extracted

• • Target

    swift Zirat Bankasi Swift Mesaji,pdf.exe

  • Size

    42KB

  • MD5

    950b2eb32fcabb720d713f05a9e621bd

  • SHA1

    8f4123b348c93691b5ef56c2280d027343686c68

  • SHA256

    f636d15642c8a199f125c5128bae3f367e7e9595af631d1080f24fc6d94fcb2a

  • SHA512

    23667ade6b2c826a10cdc303c7d0af97b79d13dfbac1eea5a4b823e12e845c104074847ae285225fc233dec920323f80ed514fe9cd81afdc1137899efbcbd226

  • SSDEEP

    384:n1YgDFY7RNpfkLxmnSj3ge0G9s3CkEZsHLEn74i/8E9VF0Ny2ZxkEZsHLEs4i/8R:1YgRmnSj3gYCB2eE/beEm

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2