Extracted

• • Target

    Inquiry_110922.exe

  • Size

    181KB

  • MD5

    dcaa23ff8b67e9603f1f076c16c69dc4

  • SHA1

    a5fee6efc8b5d1bb426f5171a118fadeea44db4f

  • SHA256

    86c12a0ecd9361e829b668493544c3f5e3b0feb7e20989e4db283b2138529dc4

  • SHA512

    5f07e68c0f6e187980f44c5efcd42b4a33c11707d5e0aa432b93c4a583df36e25a54264cdeaae22e7999cfcecba2adda969a6195a7ee4340b0cc9888520f69ce

  • SSDEEP

    768:BmhNJS/lozmCBLx7NnByW/vyvFC586HRLdi5DvXr3NZbs8Q:SDS/+ZBlZBVvMIy6HRUBb3NG8Q

  Score

  10^/10

  discoveryblustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2