Extracted

• • Target

    DICIEMBRE PEDIDO.exe

  • Size

    666KB

  • MD5

    7189393da2e6ba6d9008e6959de09a82

  • SHA1

    900d1fcd0a06b23d91dff10cc5d4393f6bac611f

  • SHA256

    1cdb944451011cd42459c89cf3442f33d0800f1078eeb62c30afaa73d9ce165d

  • SHA512

    86477d0e35322f848a5175561d4d3d4344719bd7b84bf836fba51378f5076345a8a951e5896aebd5c421d748679a7ef914b3df416b6506593c5c03d3fa4f6494

  • SSDEEP

    12288:WkvdHPnkwZ3RPHJYlOdq+014c6V5S69JTpLB1fyGzeR1ezLdH7J/T8:WkvdvkwZ3RPHJr3jpLzaGCez5N8

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2