Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    94KB

  • MD5

    d20dcb3c84f2aa9f4a139a223129dab1

  • SHA1

    0cd4a0444f83427086c9295e9074fb3827178ba0

  • SHA256

    3c0266bea1c26e7a467048c30916c7a762ec87286a827eacc71c3e474f6d1f78

  • SHA512

    adeb6dd95b4dd430334b1422f9f38e0aecd0dc6a20bea2abab2ed27b68fbc3b22cbfdc26d977d465e307547aa766db6eb9bd88c930977e411fe4bf253d9703ac

  • SSDEEP

    192:tDtGA0yeq533vXlPUN/4C/Cwuq7c7t9JdWqdjbGo1NeUyLy10EYVZpKkwSYWbecG:iM53NUI7WYLyLy10EyR9ZP4L2x+ZnP

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2