Extracted

• • Target

    Comprobante transferencia.js

  • Size

    9KB

  • MD5

    b6c2df8872800fb0ff88a0a8e18d30cd

  • SHA1

    7f4c653be69760ba00e27eed161a7357095e2766

  • SHA256

    5d1d48e562d8aa8f1da58485b809b0642a6eec54d043c183d7519020214232af

  • SHA512

    9fca0dae9ae82ab230c54f8c5c9e73376918198ec5613685b3438fd37a60f352f441c141b105b596d35464c9dfe9c386b7e291f446e0b4b8323ffafadcbba1fe

  • SSDEEP

    192:yxl1ldLn3HPgwaNjoymWe+UtEM6TKAkXqoKCpltawnbqbMzJDuDm5cttDgpjDjdW:oLrCsyzeLtEMZ/qojlhbqbANU9DglBH2

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2