Overview

overview

10

Static

static

Swift.txt.exe

windows7-x64

10

Swift.txt.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Swift.txt.exe

  • Size

    670KB

  • Sample

    220803-mghw8aaae4

  • MD5

    2de023032f1f87a7ed648c32fcf484df

  • SHA1

    17be3627191cd82331a205cd3eca02380d541aba

  • SHA256

    dfd1179ad73ebb13661fe68ec9276f503563ec578c20c1e6489e2d3666deb4cb

  • SHA512

    0a628ebde05eb454fbbb3898b166830d98e7bc0862bbc0ef3e55ace668604c4eabd607d6012608a3a465a2dc5e7aaf9f8e778fd1ae61feacdc9542f78069bed5

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      Swift.txt.exe

    • Size

      670KB

    • MD5

      2de023032f1f87a7ed648c32fcf484df

    • SHA1

      17be3627191cd82331a205cd3eca02380d541aba

    • SHA256

      dfd1179ad73ebb13661fe68ec9276f503563ec578c20c1e6489e2d3666deb4cb

    • SHA512

      0a628ebde05eb454fbbb3898b166830d98e7bc0862bbc0ef3e55ace668604c4eabd607d6012608a3a465a2dc5e7aaf9f8e778fd1ae61feacdc9542f78069bed5

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks