a310logger

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.23202.31229
Size 615KB
Sample220526-1erm8sbceq
SHA256 d410882344230e5f0e2f98fa62f97b091be51abc83cade58585c6e62bc35a1d7
MD5 e07c276f913472c39c81c9caa5ae7c2e
SHA1 c086259f3bcb0166c5e8b12e2ae3f3c82fa6dc3b
SHA512 e5c699c7dbd5b33d93faff11773575946b6bc65c407989b24bdb3dda0025d59c0a68962c7cbe4ea6210212c64966f3ad42f7ed6692d6fe04373accab4e96b368
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  SecuriteInfo.com.W32.AIDetectNet.01.23202.31229
- Size 615KB
- SHA256 d410882344230e5f0e2f98fa62f97b091be51abc83cade58585c6e62bc35a1d7
- MD5 e07c276f913472c39c81c9caa5ae7c2e
- SHA1 c086259f3bcb0166c5e8b12e2ae3f3c82fa6dc3b
- SHA512 e5c699c7dbd5b33d93faff11773575946b6bc65c407989b24bdb3dda0025d59c0a68962c7cbe4ea6210212c64966f3ad42f7ed6692d6fe04373accab4e96b368
- MD5 SHA1 SHA512
Score

10^/10

a310logger stormkitty collection spyware stealer
- A310logger
  A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware a310logger
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty Payload
- A310logger Executable
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2