Overview

overview

10

Static

static

Invoice no. 004.exe

windows7-x64

10

Invoice no. 004.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice no. 004.exe

  • Size

    626KB

  • Sample

    220727-pkfx5sdgbn

  • MD5

    5500eeff820e3f9518f14ac32df4e735

  • SHA1

    25af6b1565154eac95865b9db7944b9bbc842493

  • SHA256

    45035676e4441c255385a1436d86540859459f5b1f3105e7a21bc9c07057276c

  • SHA512

    79579fbacb4d138e39b73ccdc0a0dcc5683c7abe55691ca8f35e8c55001fd9d801122b5b9b8a5e5e64fef1e4a6508fd1bf84547bb09cc37a1c9fa6787bb2edef

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      Invoice no. 004.exe

    • Size

      626KB

    • MD5

      5500eeff820e3f9518f14ac32df4e735

    • SHA1

      25af6b1565154eac95865b9db7944b9bbc842493

    • SHA256

      45035676e4441c255385a1436d86540859459f5b1f3105e7a21bc9c07057276c

    • SHA512

      79579fbacb4d138e39b73ccdc0a0dcc5683c7abe55691ca8f35e8c55001fd9d801122b5b9b8a5e5e64fef1e4a6508fd1bf84547bb09cc37a1c9fa6787bb2edef

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks