Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    21KB

  • MD5

    637f5600bc9e451058c51aa3375fd1e5

  • SHA1

    c14318a0e020ccf5c2830940741df2cc8b8cd261

  • SHA256

    31b24d6daaf516f5fffae5cde34c047cdeb0bcd530b4d0babb3a5b5fbdfaf06e

  • SHA512

    50e43c6cf53dadfb3f02d69a55f809500a78ded85e8b5b8f675075c1628980905c7eb122091b3471731e10fdca29ff90c1ce50bbe2bf76e75b3b919dfb543510

  • SSDEEP

    192:cEeTcW0iOFLfh15JKsUBSjarhF0nxcsz7Fs2WS7M6zvlRJTHhnj4OpqZndlJ4bi:cERWkLfh15JKsUBZd2Zz5TBHCZJ5H1d

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2