Overview

overview

10

Static

static

Halkbank_E...54.exe

windows7-x64

10

Halkbank_E...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Halkbank_Ekstre_20220901_060735_484554.exe

  • Size

    900KB

  • Sample

    220901-mghw8aecb9

  • MD5

    f53d6a0d4693488835b412fb558a75d3

  • SHA1

    802139308484ab4905f5af9b40f17d01568a9790

  • SHA256

    3e2842c40ff26c60b69e08934b9b80fefe0cd2d091fbd6fa91a2b97f3487137c

  • SHA512

    561d6b80db0deca56af17f3debf422d7cfbe867629b000a0e5a232de2a1f296b2e355549edbb10866939e7ace619331919069ad54bc552b1585d4f9788d1febb

  • SSDEEP

    24576:3Z5sXY+mzo3bvQhPGbuYKeS0eVIUdJyh:J5qlmzMIlGan0eD3C

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      Halkbank_Ekstre_20220901_060735_484554.exe

    • Size

      900KB

    • MD5

      f53d6a0d4693488835b412fb558a75d3

    • SHA1

      802139308484ab4905f5af9b40f17d01568a9790

    • SHA256

      3e2842c40ff26c60b69e08934b9b80fefe0cd2d091fbd6fa91a2b97f3487137c

    • SHA512

      561d6b80db0deca56af17f3debf422d7cfbe867629b000a0e5a232de2a1f296b2e355549edbb10866939e7ace619331919069ad54bc552b1585d4f9788d1febb

    • SSDEEP

      24576:3Z5sXY+mzo3bvQhPGbuYKeS0eVIUdJyh:J5qlmzMIlGan0eD3C

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks