General
-
Target
NEW980009000.exe
-
Size
376KB
-
Sample
210827-qsfpnm8rw6
-
MD5
01e4b34085e840c3c2cebf1e0db0aa29
-
SHA1
2c1bcfac805bd6bd400389b902029eb80865f518
-
SHA256
1082af11e2e9949798b1752d511d0c134ccc7bb54147b5c83a5d0edddd236e65
-
SHA512
4c5c7c63db636ed64a12ca55fb604772fea80bbab915ff00500b54142146f1db2685d70c818430c17cbbe20a7e66d58363df3a29b67b8b4f3b4bc2535a0742ec
Malware Config
Targets
-
-
Target
NEW980009000.exe
-
Size
376KB
-
MD5
01e4b34085e840c3c2cebf1e0db0aa29
-
SHA1
2c1bcfac805bd6bd400389b902029eb80865f518
-
SHA256
1082af11e2e9949798b1752d511d0c134ccc7bb54147b5c83a5d0edddd236e65
-
SHA512
4c5c7c63db636ed64a12ca55fb604772fea80bbab915ff00500b54142146f1db2685d70c818430c17cbbe20a7e66d58363df3a29b67b8b4f3b4bc2535a0742ec
Score10/10-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload
-
A310logger Executable
-
Executes dropped EXE
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext
-