Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.32165.32177.exe

  • Size

    512KB

  • MD5

    d6d2eab2c47696c506e2c7fb2641e70c

  • SHA1

    a72a143ea22c8ecce60ad941075cf10d6b75db54

  • SHA256

    a01a796237b902283c1dedf65170d1bc27c295c5862c5f57d49851c81930e960

  • SHA512

    cb4bdfb7bba514d7e28d8337a3b94c271741e3b5429f2d1ab3d12854f3674241642d648050c57bc931cbd3c6b89ae03b6f5f5a242a3c3b9eb12ef9d37ee6ade6

  • SSDEEP

    12288:aBRpMQ140VDCjnScvA60rtrhOm4jA0khG8o9S99jq:OUQ1pVejmplIjA0kho9K9j

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2