Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    25KB

  • MD5

    aef764d141280332ade9518ffdcdcb98

  • SHA1

    65d4f7cfcd3732a45312aa38e112513ef63a4c1f

  • SHA256

    2aad22bee9e2bb4ef6370fde5e0a43b06e541235e314b5a4a52dfb8357d477c3

  • SHA512

    802f9a05a2e39863a6ddf8e1f0eabdf4c7ccd2c94d52a08fac24e7a60721d95400801ed31eb72fcb6e2bd75981a797e67ce9ef84950ea65a02e8ce3a58662c70

  • SSDEEP

    384:70EWl++F6Lv9OecKbgQBSsMcptYcFmVc03K:evsVvEsMotYcFmVc6K

  Score

  10^/10

  discoveryblustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2