Extracted

• • Target

    palmic.exe

  • Size

    66KB

  • MD5

    ec56a21c8ee1d373f5e892cc19a14441

  • SHA1

    e2834f9bfe32bb1a6b4fbb4cff128e8dcdece15b

  • SHA256

    3129b84bf731a2348ea99a5d7e03c9b52993963a88607ad149b13b7cba499f19

  • SHA512

    b78ca39248267de920b270323134d354cabee4fc434f1ba216669d504ffdc5e2b7cd45d54e48f457cfc9afb4cc1a52d91a0523fa7899ea8f36324668c0bd5532

  • SSDEEP

    768:Yy8W6IZhbT3GpO1gyapErmN7uPS/Zp8Hk/8gV90DBVpGwDO+snK5k41PMArE7+6d:YHI72gQk+NoVLsK5k410jEY+ICyjZ

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2