Overview

overview

10

Static

static

SecuriteIn...98.exe

windows7-x64

10

SecuriteIn...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.RATX-gen.14698.exe

  • Size

    141KB

  • Sample

    220908-m3dvdsedc7

  • MD5

    6d3b71b1ca2ca00cccc6cfe506391709

  • SHA1

    69ac0b6f247035d691fe78924059c139f420b599

  • SHA256

    04ed81e966c2ed610dea41efe3251e15ad3a9a899ae27a81c02e9950e4367306

  • SHA512

    c498eaf7e6cea3f2cd402b173d376bea9ffd5fab02417df6a28d5b298834b67e213904f94cdc77bf62e9df46081f6eae4b7c443baa76ae592f269e39d642d030

  • SSDEEP

    3072:bZdqCJJGPEIz3QZqzJqmjuAUa7srVqt0x5y8:7qOJG73QMAAUa7sri0x

Score
10/10
blustealerstormkittycollectionspywarestealer

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.RATX-gen.14698.exe

    • Size

      141KB

    • MD5

      6d3b71b1ca2ca00cccc6cfe506391709

    • SHA1

      69ac0b6f247035d691fe78924059c139f420b599

    • SHA256

      04ed81e966c2ed610dea41efe3251e15ad3a9a899ae27a81c02e9950e4367306

    • SHA512

      c498eaf7e6cea3f2cd402b173d376bea9ffd5fab02417df6a28d5b298834b67e213904f94cdc77bf62e9df46081f6eae4b7c443baa76ae592f269e39d642d030

    • SSDEEP

      3072:bZdqCJJGPEIz3QZqzJqmjuAUa7srVqt0x5y8:7qOJG73QMAAUa7sri0x

    Score
    10/10
    blustealerstormkittycollectionspywarestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks