Extracted

• • Target

    fatura64383,pdf.exe

  • Size

    362KB

  • MD5

    bb77706ba6e7c684bdd0b1b11fb7f5e1

  • SHA1

    e092bad0cf6528e64f0798279e7bc02f45748f82

  • SHA256

    761e4a0314cfb25685a468b01de973e51405f0de560a6c85d8cc1efa3e6ac013

  • SHA512

    01c64294fc9ca1a74b8e3921bb412ef442d2beabe2862db69e9d24f23cd568602bd926a75ca4551f56e68bc7a4a1a5c867ec3faf5169e9c7019b06c7b6a00e43

  • SSDEEP

    6144:IYa6h0+uhQMTNBGSeHP/GVLfNVfPluPVDIJ:IYQ+uhQMTDrtIPNk

  Score

  10^/10

  blustealerstormkittycollectionpersistencestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2