Overview

overview

10

Static

static

SecuriteIn...12.exe

windows7-x64

10

SecuriteIn...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Variant.Strictor.274578.28312.24364

  • Size

    852KB

  • Sample

    220815-ljtwtsbgd3

  • MD5

    ef6168fed961bcce0b3c7a63e2ab4f1a

  • SHA1

    6ecf10e6b9d9978f706f868aeebd7cf169edcf74

  • SHA256

    2bf197104a6418c886f206755e3f599ae9b1f90cf9771be981c30f427ecb228c

  • SHA512

    4ab03a35eb2ed2cbde86f73463ea9c15ed21a0d9d68b1bf1042d80797d71a001204256bcfbdb6ae0f1a16dddc2ce4a42c892e33e893eb70e2af28ccee1c69939

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      SecuriteInfo.com.Variant.Strictor.274578.28312.24364

    • Size

      852KB

    • MD5

      ef6168fed961bcce0b3c7a63e2ab4f1a

    • SHA1

      6ecf10e6b9d9978f706f868aeebd7cf169edcf74

    • SHA256

      2bf197104a6418c886f206755e3f599ae9b1f90cf9771be981c30f427ecb228c

    • SHA512

      4ab03a35eb2ed2cbde86f73463ea9c15ed21a0d9d68b1bf1042d80797d71a001204256bcfbdb6ae0f1a16dddc2ce4a42c892e33e893eb70e2af28ccee1c69939

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks