Extracted

• • Target

    e4086615e3011d916a50689cef433c77

  • Size

    5.4MB

  • MD5

    e4086615e3011d916a50689cef433c77

  • SHA1

    24c38d07046c2781f01d98ae3d7b1d9a80ea69e0

  • SHA256

    d94c8028fa7fd7062dc2cd8c78b458d68bc7c8e8e260afc827bef217aeeac693

  • SHA512

    06ed1a259f5d6f668508399e61a4465eabd642f966ea0903746ac6b4981f5df7bdaef2de231d1b50f5d271b357435aed21b81b66ed2fca78e219ea72d8db7966

  • SSDEEP

    98304:3EAKCzqdfS72BW2WLASB3MgsESIXaM3dm8j6o8DQDvALRmn6BKVq:0LNS7tASVMgdR3sWx5LALonQK4

  Score

  10^/10

  oskistormkittyinfostealerspywarestealer

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2