Overview

overview

10

Static

static

SWIFT_IMG_...df.exe

windows7-x64

1

SWIFT_IMG_...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SWIFT_IMG_20220901_00078666587900.pdf.exe

  • Size

    23KB

  • Sample

    220901-jpac9sccf4

  • MD5

    4e85dbb7ee02db82e5bc4e7e80e6a651

  • SHA1

    a591f39a808a804aa642239599fd995f3a283419

  • SHA256

    90be1936790b5dbe16e74ea0bdacedf3d7311c7427a3151769335bee789b9916

  • SHA512

    72254243cf9014df00a21142fe2c734ca8caff4603898fe4363dc726ad06b027fc3f70539613b7d35f68bfe1085b275c226cb4bdfdc10eba6404d5f0e80b4ad0

  • SSDEEP

    384:cn5wkUFE7LRM4eunOiU526JSINc+p8YlLHT5PoKVRUl:cn5wpE7LR4uOd2A1c+p8e8l

Score
10/10
blustealerstormkittycollectionpersistencestealer

Malware Config

Targets

    • Target

      SWIFT_IMG_20220901_00078666587900.pdf.exe

    • Size

      23KB

    • MD5

      4e85dbb7ee02db82e5bc4e7e80e6a651

    • SHA1

      a591f39a808a804aa642239599fd995f3a283419

    • SHA256

      90be1936790b5dbe16e74ea0bdacedf3d7311c7427a3151769335bee789b9916

    • SHA512

      72254243cf9014df00a21142fe2c734ca8caff4603898fe4363dc726ad06b027fc3f70539613b7d35f68bfe1085b275c226cb4bdfdc10eba6404d5f0e80b4ad0

    • SSDEEP

      384:cn5wkUFE7LRM4eunOiU526JSINc+p8YlLHT5PoKVRUl:cn5wpE7LR4uOd2A1c+p8e8l

    Score
    10/10
    blustealerstormkittycollectionpersistencestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks