General
-
Target
090009000N.exe
-
Size
208KB
-
Sample
210905-lw8krahea4
-
MD5
780cc6d61d19eb61fbb2566fe8f39b4a
-
SHA1
08272cd98b5d17ba7f6bf204e7b0af78a2e44957
-
SHA256
7a30162550b7e83cf48b73ad034251cbc6e053f9d20809c4f4beefaef28c8754
-
SHA512
f9e5d82b4710a8e5020007d9d1ae9eb1e2f8c682677a87617c08bc5059d148cfb2b5673c221077f96d37ae45d324b26ac4632df0f8fb1a05c35e989243f4048e
Malware Config
Targets
-
-
Target
090009000N.exe
-
Size
208KB
-
MD5
780cc6d61d19eb61fbb2566fe8f39b4a
-
SHA1
08272cd98b5d17ba7f6bf204e7b0af78a2e44957
-
SHA256
7a30162550b7e83cf48b73ad034251cbc6e053f9d20809c4f4beefaef28c8754
-
SHA512
f9e5d82b4710a8e5020007d9d1ae9eb1e2f8c682677a87617c08bc5059d148cfb2b5673c221077f96d37ae45d324b26ac4632df0f8fb1a05c35e989243f4048e
Score10/10-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload
-
A310logger Executable
-
Executes dropped EXE
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext
-