Extracted

• • Target

    RFQ.exe

  • Size

    717KB

  • MD5

    adfe5763366becc479e84b0b1269c8cc

  • SHA1

    baf4764638d384e5075d453fad14ac0fd85f7790

  • SHA256

    0c2ab8c24c4c1d47f3c1417e5e0fd327336e9a88203e414b94b66e81fa45c316

  • SHA512

    e20e62e8cc91b5c713950eef6a9164e649ea1e7c946a600c2e0ef472ee9face6cf675a3636a25a19d5dd8ef93e9b5dbb925584e9d2ed694af37deabad89b5c48

  • SSDEEP

    12288:YoqTTjquLI9jf5NsYdjsEjHnTB3IaBrB04sGNn/lBij2l0/eGRYpyuD8Iy/Je/XG:YoqD7kFRNxdjsEjzB37B04sGNn/lBijT

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2