General

  • Target

    Purchase Order 711014151.pdf.exe

  • Size

    709KB

  • Sample

    220812-gn6c7shdfl

  • MD5

    88624e9e57c3471f10b62bf0afb40c4d

  • SHA1

    d3b3df4c13d104d0b277cd243d9f5c1e6a673ead

  • SHA256

    b5141a3c6323449bc7fc031d6eb2073fcbe97754c46eef0d0d8f937b9c2fb5cb

  • SHA512

    b45c32c38416977b432b2e03b867e5e58be128e75ff2292bb07f820dec88636e7be63168b95e7413ddf86832239e138d68e8ec5fe70567e8e8cf11582919c041

Malware Config

Targets

    • Target

      Purchase Order 711014151.pdf.exe

    • Size

      709KB

    • MD5

      88624e9e57c3471f10b62bf0afb40c4d

    • SHA1

      d3b3df4c13d104d0b277cd243d9f5c1e6a673ead

    • SHA256

      b5141a3c6323449bc7fc031d6eb2073fcbe97754c46eef0d0d8f937b9c2fb5cb

    • SHA512

      b45c32c38416977b432b2e03b867e5e58be128e75ff2292bb07f820dec88636e7be63168b95e7413ddf86832239e138d68e8ec5fe70567e8e8cf11582919c041

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.