Extracted

• • Target

    1664899251557_MLCAL100300189.00.pdf.exe

  • Size

    418KB

  • MD5

    07483641fb9e47b6381039d8806aabc8

  • SHA1

    7f992d4eeae9bb1dc8936a833298bfd7ee870ffb

  • SHA256

    e3f0cf7effaf970e55ce7b44afa66607f8126403523b609849339d551011480f

  • SHA512

    8b3a201a85600c8cea9404515dd0be09fb2b41d952f5c795b36166cbfb20deef01c0d91c0da31a1a3f2a554d5e045160450a4965147824ac0244d602d4bd78cf

  • SSDEEP

    6144:KYa6AExBLoJvdNJDGcNc7rsJ1RqonlSpiHUtMj:KYC8LodlGcNc781RpSpdOj

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2