Overview

overview

10

Static

static

41974493fb...3f.exe

windows7-x64

10

41974493fb...3f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    41974493fb3bc56d1f4f9224adcf02a7adb179adf827425b6f2f29c4ab6dec3f.bin
  • Size 291KB
  • Sample220718-mrrl4scfep
  • SHA256 41974493fb3bc56d1f4f9224adcf02a7adb179adf827425b6f2f29c4ab6dec3f
  • MD5 SHA1 SHA512
Score
10/10
vulturistealer

Malware Config

Extracted

Family

  • vulturi

C2

  • http://xmarv.ddns.net:5050/gate

Attributes
  • c2_encryption_key

    testxmarvel1

  • c2_user

    root

Targets

    • Target
      41974493fb3bc56d1f4f9224adcf02a7adb179adf827425b6f2f29c4ab6dec3f.bin
    • Size 291KB
    • SHA256 41974493fb3bc56d1f4f9224adcf02a7adb179adf827425b6f2f29c4ab6dec3f
    • MD5 SHA1 SHA512
    Score
    10/10
    vulturistealer

    • Vulturi

      An info stealer written in C# and first seen in January 2021.

      stealervulturi

    • Vulturi payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks