Extracted

• • Target

    e04cc67c75ffcb323f8136e7b09e75c376d548d02410172aecc3ad6c5a5164af

  • Size

    178KB

  • MD5

    4c70eb5f963f1f34e85c715ad58bb063

  • SHA1

    819265e5c7fd3620bf3ad5c369a03cf9943a08a2

  • SHA256

    e04cc67c75ffcb323f8136e7b09e75c376d548d02410172aecc3ad6c5a5164af

  • SHA512

    85a9bec38ee3754f0b79c242cadf76f2e47b0adfcf7ae2349a98f99ef610db9fec6a33ad79ffeb53966d7f83b17694219f54e77f5d28be7e7843622be59643fc

  • SSDEEP

    3072:1/lOLu9UAiTABwneV62r2w+E9gw8GNz2Lx0+mUXfkWwJa:1dOy9UAiTABMe82IEGCN6Zfk

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1