Extracted

• • Target

    S0LICITU.EXE

  • Size

    211KB

  • MD5

    f4a13d7f220fd8db56fafbdb62828a50

  • SHA1

    ed98f720d6481db8d45aba7a3889d9974902d437

  • SHA256

    2178c25cf14793aa8845ca8ee9f76d3271c91bc5eb763e97919415f9fb7d5e1d

  • SHA512

    0d6cd19ccc47a28491f5cd442a32ec83183cc093835913cf7ca94ac679609ce648c2f15d3a11722d35d2fd5cff943abe7c073639d32e49ea294e88360cd811ac

  • SSDEEP

    3072:i748SBjtujuYWofGa2OTeyGuPMZmzsq9Y2YhuhWDNJQZ5hJ8RDMh/CQgutfxvXX4:i7MOuYCduEZ8sq9Y2RWfWMRI9Ocn4

  Score

  10^/10

  blustealerstormkittycollectionspywarestealerredlineinfostealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2