Overview

overview

10

Static

static

SecuriteIn...58.exe

windows7-x64

10

SecuriteIn...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.8058.exe

  • Size

    1.0MB

  • Sample

    220908-fv871aaggr

  • MD5

    56ef7a3ec68e156065b4ca3a21b677c0

  • SHA1

    1921d5a2f2d1094d57ed81cf0fb4f1972d5ec314

  • SHA256

    b034103df2ee0d962c9e614fc8f54ddfee1b74a815a1af90e5f90b03db3f6bab

  • SHA512

    4c5a5246a5f464cceaee9b000d21d3ae5aa88226ef6f0ab64e63ddbeacbfc302d017a472aaa89e4d0a52d40288f3c8219bf023f04e9a6978598728a1b2f413d1

  • SSDEEP

    12288:0kNjmex1ahAd3gFuKlthapQXWtG6o/mFM+aG:0kxmeLdQjrGtho/EM+

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.8058.exe

    • Size

      1.0MB

    • MD5

      56ef7a3ec68e156065b4ca3a21b677c0

    • SHA1

      1921d5a2f2d1094d57ed81cf0fb4f1972d5ec314

    • SHA256

      b034103df2ee0d962c9e614fc8f54ddfee1b74a815a1af90e5f90b03db3f6bab

    • SHA512

      4c5a5246a5f464cceaee9b000d21d3ae5aa88226ef6f0ab64e63ddbeacbfc302d017a472aaa89e4d0a52d40288f3c8219bf023f04e9a6978598728a1b2f413d1

    • SSDEEP

      12288:0kNjmex1ahAd3gFuKlthapQXWtG6o/mFM+aG:0kxmeLdQjrGtho/EM+

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks