Extracted

• • Target

    Halkbank_Ekstre_20221230_114528_468568,PDF.exe

  • Size

    415KB

  • MD5

    dd57da0ba5835d49e8c85a41641c14b2

  • SHA1

    8e823ca64e4f674953adbe045425f62f39955644

  • SHA256

    16f2160476b2c78ec35b8fd9a4430b865cf3597c0da23795181196ea682f3df0

  • SHA512

    368d505001ade291386265aa6fed0e7f6480174d3446232702174652c2fbfa1fe6906c4031efd5cc17f0330ecb38917ac95ad5a4d3b93f41453d183b3bb79602

  • SSDEEP

    12288:yYxmJxRHHE6mRsc9gC8NLhPtD/fJomIA14mwQKEuaL2dZsLqrFNOA:yYtO/fJH4mBKmL2dtHb

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2