Overview

overview

10

Static

static

b034103df2...ab.exe

windows7-x64

10

b034103df2...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b034103df2ee0d962c9e614fc8f54ddfee1b74a815a1af90e5f90b03db3f6bab.7z

  • Size

    604KB

  • Sample

    220908-ec181aafgm

  • MD5

    bf77c6a4f0d042da1ea90cb658f95ce2

  • SHA1

    1e386536cb9b6cfb47d86ab1d00b16d31e1a65ca

  • SHA256

    5d84455c995581344c9e8eeb50acc7542ddfc4077a482f2a04719b0b559c15db

  • SHA512

    fbd4ce1f99b405aa0bdf01ae0f476ddd14e26b180649cb4135bb90766e451762078d25b3fc3e9e08772a5eb6477ac272b75e056b8cff80ef6c4472dfa95ec7af

  • SSDEEP

    12288:Y/3El8FX932+JB5zrUoHaZ92wOp/BEdqePlw72IA0MJY3msbDMhDpKHFyBivC:Yvt3Vr9aZwp/+3PSSIAbKms8DpSwCC

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      b034103df2ee0d962c9e614fc8f54ddfee1b74a815a1af90e5f90b03db3f6bab.exe

    • Size

      1.0MB

    • MD5

      56ef7a3ec68e156065b4ca3a21b677c0

    • SHA1

      1921d5a2f2d1094d57ed81cf0fb4f1972d5ec314

    • SHA256

      b034103df2ee0d962c9e614fc8f54ddfee1b74a815a1af90e5f90b03db3f6bab

    • SHA512

      4c5a5246a5f464cceaee9b000d21d3ae5aa88226ef6f0ab64e63ddbeacbfc302d017a472aaa89e4d0a52d40288f3c8219bf023f04e9a6978598728a1b2f413d1

    • SSDEEP

      12288:0kNjmex1ahAd3gFuKlthapQXWtG6o/mFM+aG:0kxmeLdQjrGtho/EM+

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks