Overview

overview

10

Static

static

8

00900090KN.exe

windows7_x64

3

00900090KN.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00900090KN.zip

  • Size

    388KB

  • Sample

    210831-4vyxz8xbfe

  • MD5

    3cb44a3d7b5297101d313a11e38eeef6

  • SHA1

    1a370a78945cf635f40aed3cd6a32fbb6aa25dd5

  • SHA256

    87c44dc08a84f171306e12a0c94547cf9540d782c7c5461a0815067a2ab0e130

  • SHA512

    f886ed0ef98be670e4b5e0c46a2b1d01bb365ef657b65b3633fc36e3a498e1bce4f5d89a01f0b1c5dc972adeca173abf25177931077b138dc8e490dd78250dd1

Score
10/10
a310loggerstormkittyspywarestealerupx

Malware Config

Targets

    • Target

      00900090KN.exe

    • Size

      529KB

    • MD5

      aaf17abfdde05c49c802f36152e7332f

    • SHA1

      96cb10637d94c28163b390d11a43a2ece002d5f0

    • SHA256

      16c87c40706e8c0eee97f32fccac2fa229961b13d266e011ce411d37b864dafa

    • SHA512

      d93fe97db4fe0ba40fc53996e01c3f72e184f3646d630064ba23f718c1f3e7e8bad78078772924147262551e8ab686ac3ef46af98ccb39cd68f1c98f82f4f5b3

    Score
    10/10
    a310loggerstormkittyspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • A310logger Executable

    • Executes dropped EXE

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks