Extracted

• • Target

    SOLICITUD DE PRESUPUESTO-21-04-23.exe

  • Size

    176KB

  • MD5

    6bbfbd022b3599e8e6d8876c4566073b

  • SHA1

    b56a563f0deba1891f32866bf9385f91b3589bc0

  • SHA256

    3f6604df64307223a9a72e68f28c14d3cbf5af90549667839622b8e3490fbe8b

  • SHA512

    55e842618c3a9989c22fcbeff61c149f2e16e524ab23f7a28903b852ddbbe40defa9ab7931c06865c0bfd287a8a38b41032dcc62bd3aa144b6d84838b71a9ef7

  • SSDEEP

    3072:6nI8rM4omSUr7Boj2PjY5Yo22cEuXTWcv2yMEmzQxcfxvXX4:6UunrHPym2STW0irn4

  Score

  10^/10

  blustealerstormkittycollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2