Overview

overview

10

Static

static

swift.exe

windows7-x64

10

swift.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    swift.exe

  • Size

    845KB

  • Sample

    220826-k3wn4aacal

  • MD5

    30044dde3d49f05feb2da0947e8e6146

  • SHA1

    679429fbaab7148392d7c5c332f668aeb8a77aaf

  • SHA256

    6899dd99687066cc8f69608b5a8dfbc513609eb6232600133ebd23907fced8bc

  • SHA512

    bf1dd6f9cabae31489da9ed746a556aa4389aa01a9e715f2eb0d8242714f6863ab42e8585aa25450101f37982ce7ea6f4dede339401b3d8eaf2dee7ac4b90e95

  • SSDEEP

    24576:U3rnaj5LpegjaQzlfx/yxfFFZNYgXWsDcWI:mw5LpDDlpaxfHYO/D

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      swift.exe

    • Size

      845KB

    • MD5

      30044dde3d49f05feb2da0947e8e6146

    • SHA1

      679429fbaab7148392d7c5c332f668aeb8a77aaf

    • SHA256

      6899dd99687066cc8f69608b5a8dfbc513609eb6232600133ebd23907fced8bc

    • SHA512

      bf1dd6f9cabae31489da9ed746a556aa4389aa01a9e715f2eb0d8242714f6863ab42e8585aa25450101f37982ce7ea6f4dede339401b3d8eaf2dee7ac4b90e95

    • SSDEEP

      24576:U3rnaj5LpegjaQzlfx/yxfFFZNYgXWsDcWI:mw5LpDDlpaxfHYO/D

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks