Overview

overview

10

Static

static

hesaphareketi-01.exe

windows7-x64

10

hesaphareketi-01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hesaphareketi-01.exe

  • Size

    304KB

  • Sample

    230117-kbvygsch84

  • MD5

    437350bea5c6a15743708e40d626f6a2

  • SHA1

    84bcc16bd74838d3103308d1c34cf86f5870f2ce

  • SHA256

    da74712fd5cd155ff0404941b52156174ba6a52d8044c32657fa24901ba8dd74

  • SHA512

    8202e803cd81867320d4555d097b11b569020bc14e45b165233d4e6cf7e07d34fb88daf18be7944a5c2295f6087c3cc8e18656d3e9a4d5a99b80ff829d9c189c

  • SSDEEP

    6144:QYa69gSECqpOY0XngP6sW+/2zPELRV0nYvusV4Lh+FDciFq2FVIyMRX7J:QYLgQqpOY0XngPkLzAAnYvVV1DVNVIhX

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5468731092:AAGGNQWBVRhX622u6xp1moMhaunIGtXuIxg/sendMessage?chat_id=1639214896

Targets

    • Target

      hesaphareketi-01.exe

    • Size

      304KB

    • MD5

      437350bea5c6a15743708e40d626f6a2

    • SHA1

      84bcc16bd74838d3103308d1c34cf86f5870f2ce

    • SHA256

      da74712fd5cd155ff0404941b52156174ba6a52d8044c32657fa24901ba8dd74

    • SHA512

      8202e803cd81867320d4555d097b11b569020bc14e45b165233d4e6cf7e07d34fb88daf18be7944a5c2295f6087c3cc8e18656d3e9a4d5a99b80ff829d9c189c

    • SSDEEP

      6144:QYa69gSECqpOY0XngP6sW+/2zPELRV0nYvusV4Lh+FDciFq2FVIyMRX7J:QYLgQqpOY0XngPkLzAAnYvVV1DVNVIhX

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks