Overview

overview

10

Static

static

hesaphareketi-01.exe

windows7-x64

9

hesaphareketi-01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    msg-220822-174119.zip

  • Size

    20KB

  • Sample

    220822-wbz3zsbbel

  • MD5

    0beed2641e66cae055a975d9c4bdc204

  • SHA1

    8dfe9d861a55b85bdccaf960d915676b892a9481

  • SHA256

    e0d5b8485b278b1b74915a2d83bffeeb53e67e309620f9eaeb0f836c01813e05

  • SHA512

    046a162c41277380c34b850c1c39463f15472827bca290e84eb411422adeeb77726e43fc19768a7373707e93814529a772e43007cc08adc75f3b158834111073

  • SSDEEP

    384:TmFsWagTUN7adUNoulMV6R7E2kpsyLyR22QUX6CkBvcGdZfICY+36nD5:XWaggdAQjMVsE29eyR22ORBvcGdZ1Knd

Score
10/10
blustealerstormkittycollectiondiscoverypersistencestealer

Malware Config

Targets

    • Target

      hesaphareketi-01.exe

    • Size

      89KB

    • MD5

      a393679a29046acea89136e6924c3e19

    • SHA1

      df345f6ee3e546d6d9320dc68482f0cc643ffed5

    • SHA256

      711d00503de479cd6ffd1492e2d42eecd96c9a946c0d6bb088dd37c696a76f00

    • SHA512

      787dccef6355378219f47217850df51c7ac5a72e2a1d3a04426a89bfe2ca32d0be13a2e421b4ab0cd0c95048dc53ffec1c8a95e0a9cd349b33a6818a159042e2

    • SSDEEP

      384:rILT3gN/RBsxVxWt0WQJ6T5fnfffff9Cw3+K3Tdx9gK/yFs4Dr/L:YrCBsS0WQQ/3RBbgK/gf/L

    Score
    10/10
    discoveryblustealerstormkittycollectionpersistencestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks