Extracted

• • Target

    Payslips - Week Ending 19 October 2022.xlsm

  • Size

    42KB

  • MD5

    4cdbf369aea35107af766f0c4a928dc2

  • SHA1

    657b4e5c370ace1326b311d251d77bb3dec8a64b

  • SHA256

    ce4298647b014560cc454b87587301f11ffe7478170e7de2af59705ddf87ecc6

  • SHA512

    54407c6c226d4eba55a0afea35456224a1a9da8742c668810f0e29b112e4364ca7bff1df22257fcf21a9820a1e6e19104cf330c92e5fa5183c26340a8490c912

  • SSDEEP

    768:gvDsavqssnHOBIJYfTH+niSpyvDHrdv+nWxFFiKk/f+qtmUEURC+nQHwSrH:gvLvqTHOG1BaTrdv+KFFi3/Gq09UHQHH

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2