Extracted

• • Target

    Halkbank_Ekstre_20221228_114528_468568,PDF.exe

  • Size

    353KB

  • MD5

    c66534531458e789ad2fcdb17a3a0489

  • SHA1

    28064aa47534ed6af85b6972cca639c3dcde93ee

  • SHA256

    fd10d0c124ace345aaace7bab115d0cd3771c61919912e141924991146fc6b37

  • SHA512

    1ca186310c3f85a46a3b9782c301af137be5100f988f7adc7ba266feabb45da239d8b433c6079a1d0459bbd06647aee2812c6f67394c893eb5566090c8d1613d

  • SSDEEP

    6144:CYa6H/tWpNp5Cdqzr+yohjVpP515uGUhZzN4:CY9/tANp5/zApnPb5uGUhT4

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2