Extracted

• • Target

    hesaphareketi-01.pdf.exe

  • Size

    522KB

  • MD5

    6874fa404214cace1c3e0607f827e16e

  • SHA1

    110ca7ad3965a397badae82729be1c43ede7c670

  • SHA256

    1957dd6825a26dea37818afdad0143a9b12c2c2ec68ed0058d89b15d55c762f1

  • SHA512

    41b384435b0ec80f44df6b4e2d45877b84160dd1067a6d04e7b5684a29e06ed4fddeef6e7fa8da08997c2aa3baebfc4a3a293ffe186b1d95bb757ef1db3dd26f

  • SSDEEP

    12288:2GTIYlV2h+RZu5ZcgnziDG/kYiOaONNoZiXL1MkrupND6e:hIYlVDK8m2SsOVNNWiRMuFe

  Score

  10^/10

  blustealerstormkittystealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2