Overview

overview

10

Static

static

10

744e994a82...f1.exe

windows7-x64

10

744e994a82...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    744e994a8241e0eb8bec4d4e78b4d8f1

  • Size

    136KB

  • Sample

    220805-v59c3sfed5

  • MD5

    744e994a8241e0eb8bec4d4e78b4d8f1

  • SHA1

    a30167114f9fd84aabcd25199eb7680afce179f5

  • SHA256

    526d615c3af7609c45e44f50d6dd2e83e02c60afcdf5d3aaea1557d7a5e964de

  • SHA512

    198108e5522c37ec6000d37504a9392701ff2d171f0310fe863efcb27df4a73e007709874be02974cb0d6abd8e77c4a7189052c9b4a4fd7c01c072d1a390a6fa

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      744e994a8241e0eb8bec4d4e78b4d8f1

    • Size

      136KB

    • MD5

      744e994a8241e0eb8bec4d4e78b4d8f1

    • SHA1

      a30167114f9fd84aabcd25199eb7680afce179f5

    • SHA256

      526d615c3af7609c45e44f50d6dd2e83e02c60afcdf5d3aaea1557d7a5e964de

    • SHA512

      198108e5522c37ec6000d37504a9392701ff2d171f0310fe863efcb27df4a73e007709874be02974cb0d6abd8e77c4a7189052c9b4a4fd7c01c072d1a390a6fa

    Score
    10/10
    stormkittycollectionstealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks