Overview

overview

10

Static

static

OUTGOING P...pg.exe

windows7_x64

10

OUTGOING P...pg.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe

  • Size

    1.0MB

  • Sample

    210714-je1l3b5qda

  • MD5

    014ab849062b35196cef62addaa5335a

  • SHA1

    cc7ea1ca876a4ef7d6b2e58b1175fa3816e54ed5

  • SHA256

    444482bde8f2bb85add3dc622db0c1a7a6974a78be2039ee8d08cc32af48f951

  • SHA512

    fc73eddd6a4aaebea9421e9b848a7b890c3d7e5fd7708a743d479648e5ec6d43be45baf1ab641dba0ad531e5a3021d4a445fa26f1e982d58df5f206fa0b09902

Score
10/10
a310loggerstormkittyspywarestealer

Malware Config

Targets

    • Target

      OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe

    • Size

      1.0MB

    • MD5

      014ab849062b35196cef62addaa5335a

    • SHA1

      cc7ea1ca876a4ef7d6b2e58b1175fa3816e54ed5

    • SHA256

      444482bde8f2bb85add3dc622db0c1a7a6974a78be2039ee8d08cc32af48f951

    • SHA512

      fc73eddd6a4aaebea9421e9b848a7b890c3d7e5fd7708a743d479648e5ec6d43be45baf1ab641dba0ad531e5a3021d4a445fa26f1e982d58df5f206fa0b09902

    Score
    10/10
    a310loggerstormkittyspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • A310logger Executable

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks