Extracted

• • Target

    Halkbank_Ekstre_20221223_114527_468568,PDF.exe

  • Size

    364KB

  • MD5

    a81c89427eb400115d08cd4700910bbf

  • SHA1

    2075d329511352113528f464dd7028496f71eb78

  • SHA256

    3bb532a1c042b56a70ab6bdfc4d7ac5daf8637a34455b84f2b1e910534a8e026

  • SHA512

    fc4191a98cd717ef92bd9e9663864d1ea91baef3309c38c9df9a21940e1f40945c81a2c67dccdc07e0ba4098c8ec90a6647dd5fa0e685e72599bcf72cb0b8a87

  • SSDEEP

    6144:WkwFayrbJQxwr+HhqUtUH4onE5y9b66LXN4i:bgOxwrOtUHhEGLb

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2