Extracted

• • Target

    hesaphareketi-01.pdf.js

  • Size

    410KB

  • MD5

    bcb9093850861749082e61b189227937

  • SHA1

    0af77c3cd52b18828eb1a77867ce05e05d5bc31b

  • SHA256

    ba6268a4198e952cbf7f0cd2af1151207dd0271331069176394539011db32354

  • SHA512

    ce52bdd09673a56d968f14ca5c25ffa7040c143045f582f00630720bfa3f29b24f45145c6374cd051052411846cc14cb6c2d6bce0715dbf9b0153ebbef4e91db

  • SSDEEP

    6144:8Fo+/qDQ5e3ID89uFO1U0PZbXWDtZTuAMmoqME+NYloH:vh8uID8O0xbyZTxZOYQ

  Score

  10^/10

  blustealerstormkittystealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2