Overview

overview

10

Static

static

hesaphareketi-01.exe

windows7-x64

1

hesaphareketi-01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hesaphareketi-01.exe

  • Size

    199KB

  • Sample

    220818-xxmv8adef7

  • MD5

    763d9190632ec79c4d4b2db0e8e2e39c

  • SHA1

    d4b2dfe9f68367c09ebcc0dc2a4077ea145f545e

  • SHA256

    e49f6e36c94b304ac5712768ac5d46b85297a8d929587a53668ece785cceb509

  • SHA512

    d730e6ae29d6d6fd1f24ec1730b7df6fd4fcc981e8f0796dcdd700ce0e9dc3b7286d91fc49bfb2a36f3afb17700b00db9896fc2096aef2a1858c4846d767b94e

  • SSDEEP

    3072:QsMBl3nPWlVQ9CKQ0UUVUUXjNBv2t5DkfMK:Q1znE6gKot

Score
10/10
blustealerstormkittycollectionpersistencestealer

Malware Config

Targets

    • Target

      hesaphareketi-01.exe

    • Size

      199KB

    • MD5

      763d9190632ec79c4d4b2db0e8e2e39c

    • SHA1

      d4b2dfe9f68367c09ebcc0dc2a4077ea145f545e

    • SHA256

      e49f6e36c94b304ac5712768ac5d46b85297a8d929587a53668ece785cceb509

    • SHA512

      d730e6ae29d6d6fd1f24ec1730b7df6fd4fcc981e8f0796dcdd700ce0e9dc3b7286d91fc49bfb2a36f3afb17700b00db9896fc2096aef2a1858c4846d767b94e

    • SSDEEP

      3072:QsMBl3nPWlVQ9CKQ0UUVUUXjNBv2t5DkfMK:Q1znE6gKot

    Score
    10/10
    blustealerstormkittycollectionpersistencestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks