Extracted

• • Target

    SecuriteInfo.com.W32.MSIL_Agent.DSJ.gen.Eldorado.11406.11467.exe

  • Size

    22KB

  • MD5

    1310646bc42b16eb07ffe30fe7ffc2cc

  • SHA1

    9b24e599bfdb6ea1f31594400b155daba1e33c5f

  • SHA256

    8a07f89b4dee439c3440a9aea91436c3d73f0e07504a0b841b9ac56cb423aca0

  • SHA512

    b2ebbb5a836c3ea5c00ba84272b9463d30eded1e955eace75b15f4f1431c5f421b64b40d6cc568ab417358a83fa5c5a0fa4592c33a19c195f69f64764cb017ca

  • SSDEEP

    384:ftxafuqsQniJnOUYjxJhT7KSENddXLH51NnnjLYbjmjI:fdoKnXLH51NnnkyjI

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2