blustealer | 3909f1e1d41d36e0f62bd770841a0a8ea28c2b7d52f2e2fc77457538fbd7a291 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Revised sh...df.exe

windows7-x64

Revised sh...df.exe

windows10-2004-x64

Sharing

General

Target

Revised shipment.pdf.exe
Size

706KB
Sample

220805-neacqscag2
MD5

f79203454fd766c8189d00c43cfc7485
SHA1

fe44898d206f0b4ef9497e7b7b2e9dedcd4335aa
SHA256

3909f1e1d41d36e0f62bd770841a0a8ea28c2b7d52f2e2fc77457538fbd7a291
SHA512

2b88a745ec24591e5a5b28ade1470416a6bfe2bed86383c276736d0142ddae64bf985cd84772ac00512868f1741f3a7cab555a7a53f95eb5408a582d0fbb8ad1

Score

10^/10

blustealer stormkitty collection stealer

Static task

static1

Behavioral task

behavioral1

Sample

Revised shipment.pdf.exe

Resource

win7-20220718-en

blustealer stormkitty collection stealer

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

Revised shipment.pdf.exe

Resource

win10v2004-20220721-en

blustealer stormkitty collection stealer

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  Revised shipment.pdf.exe
- Size
  
  706KB
- MD5
  
  f79203454fd766c8189d00c43cfc7485
- SHA1
  
  fe44898d206f0b4ef9497e7b7b2e9dedcd4335aa
- SHA256
  
  3909f1e1d41d36e0f62bd770841a0a8ea28c2b7d52f2e2fc77457538fbd7a291
- SHA512
  
  2b88a745ec24591e5a5b28ade1470416a6bfe2bed86383c276736d0142ddae64bf985cd84772ac00512868f1741f3a7cab555a7a53f95eb5408a582d0fbb8ad1
Score

10^/10

blustealer stormkitty collection stealer
- BluStealer
  A Modular information stealer written in Visual Basic.
  stealer blustealer
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blustealerstormkittycollectionstealer

behavioral2

blustealerstormkittycollectionstealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.