General
-
Target
BloodyHub.exe
-
Size
1.1MB
-
Sample
230105-yaerrsgf3y
-
MD5
447c9c635e13daca216df7175f97dab9
-
SHA1
3fe9ae83f79dfc2962d51add9e40efc2235f4a03
-
SHA256
41badc950a9ab5946733f104ce4af17ad7b27534a0641c6e60bb50c5f42d4a2a
-
SHA512
15be9c482d1c49a4ce623fd2e6e9d13f8e65b5d82ea7be5e976301fd81eca9c1a3974b6db0ef45efd9a5908d8297b6e9c7c2b959e1f3e87981aab46839b514bd
-
SSDEEP
24576:zh3NXaV9x4IUgs36BUI2So5+jnzFoCaGApu8t:zl0T+Sk6BU7HIFo7G98
Behavioral task
behavioral1
Sample
BloodyHub.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BloodyHub.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
BloodyHub.exe
-
Size
1.1MB
-
MD5
447c9c635e13daca216df7175f97dab9
-
SHA1
3fe9ae83f79dfc2962d51add9e40efc2235f4a03
-
SHA256
41badc950a9ab5946733f104ce4af17ad7b27534a0641c6e60bb50c5f42d4a2a
-
SHA512
15be9c482d1c49a4ce623fd2e6e9d13f8e65b5d82ea7be5e976301fd81eca9c1a3974b6db0ef45efd9a5908d8297b6e9c7c2b959e1f3e87981aab46839b514bd
-
SSDEEP
24576:zh3NXaV9x4IUgs36BUI2So5+jnzFoCaGApu8t:zl0T+Sk6BU7HIFo7G98
Score10/10-
StormKitty payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-