Resubmissions

31-05-2021 12:55

210531-5j3tfy65pn 10

31-05-2021 12:08

210531-83jrfbhyba 10

General

  • Target

    Statement SKBMT 09418.exe

  • Size

    993KB

  • Sample

    210531-83jrfbhyba

  • MD5

    16fdc46350203434497e1741ea5cd20a

  • SHA1

    f75824509e9ce1b77194724fd34c60bc0c9d28f1

  • SHA256

    1018d102af9093b9a03abe9a660360db6be8f752d992bb7159475fccd78949f5

  • SHA512

    a71d6af40387a94c52d54438fea392969f5f0a330867dc7a2d05de5c07fdfb26724270ca3bbbfaf1ceddd2338254eb158e9ada092fa622315627f0b0553fee12

Malware Config

Targets

    • Target

      Statement SKBMT 09418.exe

    • Size

      993KB

    • MD5

      16fdc46350203434497e1741ea5cd20a

    • SHA1

      f75824509e9ce1b77194724fd34c60bc0c9d28f1

    • SHA256

      1018d102af9093b9a03abe9a660360db6be8f752d992bb7159475fccd78949f5

    • SHA512

      a71d6af40387a94c52d54438fea392969f5f0a330867dc7a2d05de5c07fdfb26724270ca3bbbfaf1ceddd2338254eb158e9ada092fa622315627f0b0553fee12

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty Payload

    • A310logger Executable

    • Executes dropped EXE

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks