Overview

overview

10

Static

static

000100049000TK.exe

windows7_x64

1

000100049000TK.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    000100049000TK.zip

  • Size

    460KB

  • Sample

    210727-6a2r791kge

  • MD5

    59afe3436eee2e9f3c9a5556cf33cef7

  • SHA1

    43078f70d254753e59c8a920a7f27a1f5cc8e31f

  • SHA256

    39cd5c2dd4929b254d9ef4bf758ce2401e49fd5da55ae97ad1939db2cc3acdce

  • SHA512

    2ec7599b3e7521d65c47f9289d4dd118ae8274634d4cf2a1cff6d701d62dbf650b8d82f3fc9826def01afcb498a4d5278e3664ed01cad354f195a037f90887af

Score
10/10
a310loggerstormkittyspywarestealer

Malware Config

Targets

    • Target

      000100049000TK.exe

    • Size

      955KB

    • MD5

      113f59d0bd4384226e40c17bf899935d

    • SHA1

      4bf159402cefe87d328182fee0e82297b1fff5c5

    • SHA256

      b77f7c59b071608e552cf6ccae6f9e0e3f6790d83ec7d163713b0eedc6eccf25

    • SHA512

      d8e3717916475013e8ec8cc5a5fef303c4467fe66b944f1031ee73ad964a6a699d3c872a305173ac7565e5000ade605e8cef1cbe3ca9438ac1f85993a69a3b78

    Score
    10/10
    a310loggerstormkittyspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • A310logger Executable

    • Executes dropped EXE

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks