Overview

overview

10

Static

static

hesaphareketi-01.exe

windows7-x64

1

hesaphareketi-01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hesaphareketi-01.exe

  • Size

    89KB

  • Sample

    220822-sa2cwahcek

  • MD5

    a393679a29046acea89136e6924c3e19

  • SHA1

    df345f6ee3e546d6d9320dc68482f0cc643ffed5

  • SHA256

    711d00503de479cd6ffd1492e2d42eecd96c9a946c0d6bb088dd37c696a76f00

  • SHA512

    787dccef6355378219f47217850df51c7ac5a72e2a1d3a04426a89bfe2ca32d0be13a2e421b4ab0cd0c95048dc53ffec1c8a95e0a9cd349b33a6818a159042e2

  • SSDEEP

    384:rILT3gN/RBsxVxWt0WQJ6T5fnfffff9Cw3+K3Tdx9gK/yFs4Dr/L:YrCBsS0WQQ/3RBbgK/gf/L

Score
10/10
blustealerstormkittycollectionpersistencestealer

Malware Config

Targets

    • Target

      hesaphareketi-01.exe

    • Size

      89KB

    • MD5

      a393679a29046acea89136e6924c3e19

    • SHA1

      df345f6ee3e546d6d9320dc68482f0cc643ffed5

    • SHA256

      711d00503de479cd6ffd1492e2d42eecd96c9a946c0d6bb088dd37c696a76f00

    • SHA512

      787dccef6355378219f47217850df51c7ac5a72e2a1d3a04426a89bfe2ca32d0be13a2e421b4ab0cd0c95048dc53ffec1c8a95e0a9cd349b33a6818a159042e2

    • SSDEEP

      384:rILT3gN/RBsxVxWt0WQJ6T5fnfffff9Cw3+K3Tdx9gK/yFs4Dr/L:YrCBsS0WQQ/3RBbgK/gf/L

    Score
    10/10
    blustealerstormkittycollectionpersistencestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks