Extracted

• • Target

    hesaphareketi-01.pdf.bin.exe

  • Size

    307KB

  • MD5

    2c3fbb2cee9b79530534e53064ff68a2

  • SHA1

    0f8a016173e7202ec2abe46ae038016fcd1b7742

  • SHA256

    0107b32e98dba4ef3826e16bd3d5e03a8b277a5bfe9bd20c5ee110596cf00f07

  • SHA512

    d605dcef74eba2509d171b7853b95595d2166f0001974d25716b52a790939e0b3b563efb14d336c6eefdf8adf52f3f4a56782eb037ec31f4d8c7515b0bfd78ec

  • SSDEEP

    3072:CL36cR9EKJjjTeRVMHDAc2ik58O0uE9QoRsCm5ndL3qNP6q7DFfDnB7EsetTGK4E:D8JnTyKEuDvQoR/mrLqNSynyh+yWki

  Score

  10^/10

  blustealerstormkittystealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2