Overview

overview

10

Static

static

swift.exe

windows7-x64

10

swift.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    swift.exe

  • Size

    834KB

  • Sample

    220906-larecaadg3

  • MD5

    ed087331c9c97859d6d30bca5245b42d

  • SHA1

    6f1f422171174486c9de328041a0606273b763aa

  • SHA256

    15af08408332677507425dd21c6e04fa469e1129c21dc9ae2d830cc5c8aa0642

  • SHA512

    336290c2b7b578fd9022b8d2b5708f27be6e56a8ac2cdcc2369a705896ad00a6920c76d295f24715c3063de4e71e7829cccd80a1c63558dc662b7544522daf0a

  • SSDEEP

    12288:nF75eRgPwqoXY+mzoRtbvRT7PJ7Na+6ZmvatTu7Fm8gAxYS6L9ETD:nZ5wXY+mzo3bv/Ra+CmiRusyYD

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      swift.exe

    • Size

      834KB

    • MD5

      ed087331c9c97859d6d30bca5245b42d

    • SHA1

      6f1f422171174486c9de328041a0606273b763aa

    • SHA256

      15af08408332677507425dd21c6e04fa469e1129c21dc9ae2d830cc5c8aa0642

    • SHA512

      336290c2b7b578fd9022b8d2b5708f27be6e56a8ac2cdcc2369a705896ad00a6920c76d295f24715c3063de4e71e7829cccd80a1c63558dc662b7544522daf0a

    • SSDEEP

      12288:nF75eRgPwqoXY+mzoRtbvRT7PJ7Na+6ZmvatTu7Fm8gAxYS6L9ETD:nZ5wXY+mzo3bv/Ra+CmiRusyYD

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks