General
-
Target
TU09000090.exe
-
Size
678KB
-
Sample
210715-fzy7gxfrzx
-
MD5
58d412f616a769bcca7441a8d5408cf3
-
SHA1
a051fb0ed9bfc514a1c792fada3582017034da49
-
SHA256
8d3cd8573aa9b73d387284b0bd7421daf2914774153423ad74c837361b822782
-
SHA512
78e47adbe51a689210587a38c6656d936fa3544128ec1894f841d198d0025e3d52e922681c1251b050c60b39374f2e187b8c61a7972770f077f4fd0fb955f387
Malware Config
Targets
-
-
Target
TU09000090.exe
-
Size
678KB
-
MD5
58d412f616a769bcca7441a8d5408cf3
-
SHA1
a051fb0ed9bfc514a1c792fada3582017034da49
-
SHA256
8d3cd8573aa9b73d387284b0bd7421daf2914774153423ad74c837361b822782
-
SHA512
78e47adbe51a689210587a38c6656d936fa3544128ec1894f841d198d0025e3d52e922681c1251b050c60b39374f2e187b8c61a7972770f077f4fd0fb955f387
Score10/10-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload
-
A310logger Executable
-
Executes dropped EXE
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext
-