Overview

overview

10

Static

static

87482.xlsx

windows7_x64

10

87482.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87482.xlsx

  • Size

    1.1MB

  • Sample

    210712-xpz3fdls2n

  • MD5

    691c1f98e15a9adfad552d13a383900c

  • SHA1

    b8b48ea114731bbe1f93074c5e57a7dc877aab36

  • SHA256

    7fdb072b859acf022effc3f1033b96b2c7f90faaecac8352c3e39db31c53cdaf

  • SHA512

    3ca064d10d8884014c4e56ef542a93afb8a0f1904323a26ac1f006007e74a5ff2414ace9df1bd8025113e87a3872a53f6dd22a893b1787cb666d28b255891fe5

Score
10/10
a310loggerstormkittyspywarestealer

Malware Config

Targets

    • Target

      87482.xlsx

    • Size

      1.1MB

    • MD5

      691c1f98e15a9adfad552d13a383900c

    • SHA1

      b8b48ea114731bbe1f93074c5e57a7dc877aab36

    • SHA256

      7fdb072b859acf022effc3f1033b96b2c7f90faaecac8352c3e39db31c53cdaf

    • SHA512

      3ca064d10d8884014c4e56ef542a93afb8a0f1904323a26ac1f006007e74a5ff2414ace9df1bd8025113e87a3872a53f6dd22a893b1787cb666d28b255891fe5

    Score
    10/10
    a310loggerstormkittyspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • A310logger Executable

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks