Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    597KB

  • MD5

    da88f31c52b2e7db62ae5840870b2a37

  • SHA1

    7ba2fc17c47159045f52ca317c581f2a2b79939f

  • SHA256

    d079abc9b57395804589c2583f98855b02d8aab8f850df5c56a9ce0aa1114508

  • SHA512

    c7a78c7026e6a2dbf3080d19c7ff311448e3c59f937f1d2b8397965f872fffad10f8c2be1385284ec9ab24d1d6ce87f021da90a2f8307729f0ba116a5872823b

  • SSDEEP

    12288:7acepbKbfqHbOAHD0j356a5R6P2mQtqSBwAqV+:7ZMbKibZHD0zz5EemaqswT

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2