Overview

overview

10

Static

static

hesaphareketi.exe

windows7-x64

6

hesaphareketi.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hesaphareketi.exe

  • Size

    242KB

  • Sample

    220825-xr3dqahcgn

  • MD5

    c66347958b1a61cfdebb3c9e9b97f0be

  • SHA1

    aedef9e586da499418f10f9e440633df8331c0d1

  • SHA256

    1c0d0b7350789ac3cd3aaac71175646d9f06f9240689be3b62293e94ffc12658

  • SHA512

    06574dcb091764a7c69125c72b3d1d8512ccfc5bea092fd7d7fd10acebbad061fae6bfa20aa04b40afc84b6cb3505505b2029515415d65e28efb302d796ccdef

  • SSDEEP

    3072:bSyxlHtVN9yzH+T6gqPPIvuvHQFpaIYkKEPIFJzE17vtE:bhVs159HsaIYkb

Score
10/10
blustealerstormkittydiscoverystealer

Malware Config

Targets

    • Target

      hesaphareketi.exe

    • Size

      242KB

    • MD5

      c66347958b1a61cfdebb3c9e9b97f0be

    • SHA1

      aedef9e586da499418f10f9e440633df8331c0d1

    • SHA256

      1c0d0b7350789ac3cd3aaac71175646d9f06f9240689be3b62293e94ffc12658

    • SHA512

      06574dcb091764a7c69125c72b3d1d8512ccfc5bea092fd7d7fd10acebbad061fae6bfa20aa04b40afc84b6cb3505505b2029515415d65e28efb302d796ccdef

    • SSDEEP

      3072:bSyxlHtVN9yzH+T6gqPPIvuvHQFpaIYkKEPIFJzE17vtE:bhVs159HsaIYkb

    Score
    10/10
    discoveryblustealerstormkittystealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks