Extracted

• • Target

    5afb4e6a861525cd433a70e5249c5a85573b4282f1b292e175f4737ba13eff56.exe

  • Size

    205KB

  • MD5

    31503bd1455f4dc0288263ecbc7af2d4

  • SHA1

    ac35a7aa76f1b8c9be148f2a835adb12295125ce

  • SHA256

    5afb4e6a861525cd433a70e5249c5a85573b4282f1b292e175f4737ba13eff56

  • SHA512

    0dc1124cf9b6189e43a4cddd9045e2f13845e6d935fd72faee52331fc070c0a979a66657df0332c91850e620bdf368bab0d33561fc6051055b1597ad2a7e0f5a

  • SSDEEP

    3072:ayEdA7fMpvQVOl3uutPT8ahmHwbQ6rLr4UEW4FP1y86vLabNCdRQav3Iyc2Ab8Fs:a23UTLhmQs6rlEWApqLaUdRrPAbin4

  Score

  10^/10

  blustealerstormkittystealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2