Overview

overview

10

Static

static

090009000N.exe

windows7_x64

1

090009000N.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    090009000N.zip

  • Size

    101KB

  • Sample

    210905-lw79zscffn

  • MD5

    1a6b2681aa6b7b22892812db44c40650

  • SHA1

    5db040af639744958921bfde663df0d8ff1454e3

  • SHA256

    bea7fc2e0fd9a1a0eb1382285dcbff3db76a372c18249673bf331257bac602af

  • SHA512

    3156e366d40e1a1d531ce217c26bfab5059b50ee97fe4564bdc5f7af0c0d3b6e0d9c59854277798e9d89bb13831bbfaf5cf3dca73825b6c0b0d237ada54d5b1c

Score
10/10
a310loggerstormkittyspywarestealer

Malware Config

Targets

    • Target

      090009000N.exe

    • Size

      208KB

    • MD5

      780cc6d61d19eb61fbb2566fe8f39b4a

    • SHA1

      08272cd98b5d17ba7f6bf204e7b0af78a2e44957

    • SHA256

      7a30162550b7e83cf48b73ad034251cbc6e053f9d20809c4f4beefaef28c8754

    • SHA512

      f9e5d82b4710a8e5020007d9d1ae9eb1e2f8c682677a87617c08bc5059d148cfb2b5673c221077f96d37ae45d324b26ac4632df0f8fb1a05c35e989243f4048e

    Score
    10/10
    a310loggerstormkittyspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • A310logger Executable

    • Executes dropped EXE

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks