Overview

overview

10

Static

static

ΕΝΤΟΛ.....exe

windows7-x64

10

ΕΝΤΟΛ.....exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ΕΝΤΟΛΉ ΑΓΟΡΆς ΓΙΑ ΕΙΣΑΓΩΓΈς ΜΑΥΡΊΚΟΥ Α.Ε..exe

  • Size

    355KB

  • Sample

    221003-hsnvdscdb8

  • MD5

    1b8441c90b20b939771406caccc6ac06

  • SHA1

    2d3eadb90ab50cc38234624405d80bf68ffead05

  • SHA256

    d5c56ddf8cc57609f24c6a9af1964b2c51d10418edaf126ab3c8293bead46a9e

  • SHA512

    4f777c55c705c910632a24282339bed28549cbfcc92f2ecd1fef46e99bc01b2c114395cdd201c3801823198f22aa5aed35f131a7808116421c5a584f3775266b

  • SSDEEP

    3072:lYcjrYOiFaVJTL/Tb4aOivVq59lIiif8H18VAagOq5QZGZH+9wqY+mhhhmitqOuv:l6O2aVJHflvVq59lekzXOq56GBKi

Score
10/10
blustealerstormkittycollectionspywarestealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5567605125:AAF5a-eiGBTc0sQavelBpgmYIQTDu4ndQ8/sendMessage?chat_id=5442288318

Targets

    • Target

      ΕΝΤΟΛΉ ΑΓΟΡΆς ΓΙΑ ΕΙΣΑΓΩΓΈς ΜΑΥΡΊΚΟΥ Α.Ε..exe

    • Size

      355KB

    • MD5

      1b8441c90b20b939771406caccc6ac06

    • SHA1

      2d3eadb90ab50cc38234624405d80bf68ffead05

    • SHA256

      d5c56ddf8cc57609f24c6a9af1964b2c51d10418edaf126ab3c8293bead46a9e

    • SHA512

      4f777c55c705c910632a24282339bed28549cbfcc92f2ecd1fef46e99bc01b2c114395cdd201c3801823198f22aa5aed35f131a7808116421c5a584f3775266b

    • SSDEEP

      3072:lYcjrYOiFaVJTL/Tb4aOivVq59lIiif8H18VAagOq5QZGZH+9wqY+mhhhmitqOuv:l6O2aVJHflvVq59lekzXOq56GBKi

    Score
    10/10
    blustealerstormkittycollectionspywarestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks