General

  • Target

    hesaphareketi-01.exe

  • Size

    25KB

  • Sample

    221031-jww6lsadc4

  • MD5

    aef764d141280332ade9518ffdcdcb98

  • SHA1

    65d4f7cfcd3732a45312aa38e112513ef63a4c1f

  • SHA256

    2aad22bee9e2bb4ef6370fde5e0a43b06e541235e314b5a4a52dfb8357d477c3

  • SHA512

    802f9a05a2e39863a6ddf8e1f0eabdf4c7ccd2c94d52a08fac24e7a60721d95400801ed31eb72fcb6e2bd75981a797e67ce9ef84950ea65a02e8ce3a58662c70

  • SSDEEP

    384:70EWl++F6Lv9OecKbgQBSsMcptYcFmVc03K:evsVvEsMotYcFmVc6K

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5412597166:AAGUaWxuTxxhNb-NRhiURcTMzuW9nhGoEs/sendMessage?chat_id=932962718

Targets

    • Target

      hesaphareketi-01.exe

    • Size

      25KB

    • MD5

      aef764d141280332ade9518ffdcdcb98

    • SHA1

      65d4f7cfcd3732a45312aa38e112513ef63a4c1f

    • SHA256

      2aad22bee9e2bb4ef6370fde5e0a43b06e541235e314b5a4a52dfb8357d477c3

    • SHA512

      802f9a05a2e39863a6ddf8e1f0eabdf4c7ccd2c94d52a08fac24e7a60721d95400801ed31eb72fcb6e2bd75981a797e67ce9ef84950ea65a02e8ce3a58662c70

    • SSDEEP

      384:70EWl++F6Lv9OecKbgQBSsMcptYcFmVc03K:evsVvEsMotYcFmVc6K

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks