Overview

overview

10

Static

static

9ec869cb94...eb.exe

windows7_x64

10

9ec869cb94...eb.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ec869cb94d730926ac5bd94ee0724e5bb8a94eb

  • Size

    476KB

  • Sample

    210729-dxela58gge

  • MD5

    f5bf7345faf95d1997b4db8d72018a62

  • SHA1

    9ec869cb94d730926ac5bd94ee0724e5bb8a94eb

  • SHA256

    5d3e5503103fe87851128da37f39fdc2e500d7bbf9f69e681745e582db9450a5

  • SHA512

    7ad9c11158402a42d6b601cf467b2d0093439d9aae85fc3eab9f5f631ec1398298b2c7b10b9be6a7b88d0f9a41e16e99de1f6403b4dd2f0a4ed64b908b1de302

Score
10/10
a310loggerstormkittyspywarestealer

Malware Config

Targets

    • Target

      9ec869cb94d730926ac5bd94ee0724e5bb8a94eb

    • Size

      476KB

    • MD5

      f5bf7345faf95d1997b4db8d72018a62

    • SHA1

      9ec869cb94d730926ac5bd94ee0724e5bb8a94eb

    • SHA256

      5d3e5503103fe87851128da37f39fdc2e500d7bbf9f69e681745e582db9450a5

    • SHA512

      7ad9c11158402a42d6b601cf467b2d0093439d9aae85fc3eab9f5f631ec1398298b2c7b10b9be6a7b88d0f9a41e16e99de1f6403b4dd2f0a4ed64b908b1de302

    Score
    10/10
    a310loggerstormkittyspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • A310logger Executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks