Extracted

• • Target

    3d075bfc29b9d4f17ac60eea8e58a1ebe94f2af614e1637e591799338984750b

  • Size

    136KB

  • MD5

    1e3b9b3c9243ad08a9a71c1c5815b194

  • SHA1

    54e370ed00b51781d527f0d09f3ee69245d2d46f

  • SHA256

    3d075bfc29b9d4f17ac60eea8e58a1ebe94f2af614e1637e591799338984750b

  • SHA512

    8b4e90be92462e99e41de3449cd1a03dd38f03ed4d258bd5e397b1f8600909fd354ab5eaf09e098183dd901b731d231d12d0ef1b6cd8103322fb1a22db86b29b

  • SSDEEP

    1536:L/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoViorkfPPJICi5h3eF13:bZTkLfhjFSiO3odkfP7iHyV

  Score

  10^/10

  stormkittycollectionstealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2