Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    hesaphareketi-01.exe

  • Size

    21KB

  • Sample

    221006-nfenvahbf5

  • MD5

    637f5600bc9e451058c51aa3375fd1e5

  • SHA1

    c14318a0e020ccf5c2830940741df2cc8b8cd261

  • SHA256

    31b24d6daaf516f5fffae5cde34c047cdeb0bcd530b4d0babb3a5b5fbdfaf06e

  • SHA512

    50e43c6cf53dadfb3f02d69a55f809500a78ded85e8b5b8f675075c1628980905c7eb122091b3471731e10fdca29ff90c1ce50bbe2bf76e75b3b919dfb543510

  • SSDEEP

    192:cEeTcW0iOFLfh15JKsUBSjarhF0nxcsz7Fs2WS7M6zvlRJTHhnj4OpqZndlJ4bi:cERWkLfh15JKsUBZd2Zz5TBHCZJ5H1d

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5576673774:AAF__hFRh9bcJV72HkFb-9eZR9JNNyuOmFM/sendMessage?chat_id=1194722650

Targets

    • Target

      hesaphareketi-01.exe

    • Size

      21KB

    • MD5

      637f5600bc9e451058c51aa3375fd1e5

    • SHA1

      c14318a0e020ccf5c2830940741df2cc8b8cd261

    • SHA256

      31b24d6daaf516f5fffae5cde34c047cdeb0bcd530b4d0babb3a5b5fbdfaf06e

    • SHA512

      50e43c6cf53dadfb3f02d69a55f809500a78ded85e8b5b8f675075c1628980905c7eb122091b3471731e10fdca29ff90c1ce50bbe2bf76e75b3b919dfb543510

    • SSDEEP

      192:cEeTcW0iOFLfh15JKsUBSjarhF0nxcsz7Fs2WS7M6zvlRJTHhnj4OpqZndlJ4bi:cERWkLfh15JKsUBZd2Zz5TBHCZJ5H1d

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks