a310logger

General

Target
Statement SKBMT 09418.exe
Size 993KB
Sample210531-83jrfbhyba
SHA256 1018d102af9093b9a03abe9a660360db6be8f752d992bb7159475fccd78949f5
MD5 16fdc46350203434497e1741ea5cd20a
SHA1 f75824509e9ce1b77194724fd34c60bc0c9d28f1
SHA512 a71d6af40387a94c52d54438fea392969f5f0a330867dc7a2d05de5c07fdfb26724270ca3bbbfaf1ceddd2338254eb158e9ada092fa622315627f0b0553fee12
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  Statement SKBMT 09418.exe
- Size 993KB
- SHA256 1018d102af9093b9a03abe9a660360db6be8f752d992bb7159475fccd78949f5
- MD5 16fdc46350203434497e1741ea5cd20a
- SHA1 f75824509e9ce1b77194724fd34c60bc0c9d28f1
- SHA512 a71d6af40387a94c52d54438fea392969f5f0a330867dc7a2d05de5c07fdfb26724270ca3bbbfaf1ceddd2338254eb158e9ada092fa622315627f0b0553fee12
- MD5 SHA1 SHA512
Score

10^/10

a310logger stormkitty spyware stealer
- A310logger
  A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware a310logger
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty Payload
- A310logger Executable
- Executes dropped EXE
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

StormKitty

StormKitty Payload

A310logger Executable

Executes dropped EXE

Reads local data of messenger clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Looks up geolocation information via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2