Overview

overview

10

Static

static

Statement ...18.exe

windows7_x64

10

Statement ...18.exe

windows10_x64

10

Resubmissions

31-05-2021 12:55

210531-5j3tfy65pn 10

31-05-2021 12:08

210531-83jrfbhyba 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Statement SKBMT 09418.exe

  • Size

    993KB

  • Sample

    210531-83jrfbhyba

  • MD5

    16fdc46350203434497e1741ea5cd20a

  • SHA1

    f75824509e9ce1b77194724fd34c60bc0c9d28f1

  • SHA256

    1018d102af9093b9a03abe9a660360db6be8f752d992bb7159475fccd78949f5

  • SHA512

    a71d6af40387a94c52d54438fea392969f5f0a330867dc7a2d05de5c07fdfb26724270ca3bbbfaf1ceddd2338254eb158e9ada092fa622315627f0b0553fee12

Score
10/10
a310loggerstormkittyspywarestealer

Malware Config

Targets

    • Target

      Statement SKBMT 09418.exe

    • Size

      993KB

    • MD5

      16fdc46350203434497e1741ea5cd20a

    • SHA1

      f75824509e9ce1b77194724fd34c60bc0c9d28f1

    • SHA256

      1018d102af9093b9a03abe9a660360db6be8f752d992bb7159475fccd78949f5

    • SHA512

      a71d6af40387a94c52d54438fea392969f5f0a330867dc7a2d05de5c07fdfb26724270ca3bbbfaf1ceddd2338254eb158e9ada092fa622315627f0b0553fee12

    Score
    10/10
    a310loggerstormkittyspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • A310logger Executable

    • Executes dropped EXE

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks