Overview

overview

10

Static

static

10

1052-67-0x...ry.exe

windows7-x64

10

1052-67-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1052-67-0x0000000000400000-0x0000000000422000-memory.dmp

  • Size

    136KB

  • Sample

    220901-mk8xtacccr

  • MD5

    b118fb3925ee0988963731f47d9839be

  • SHA1

    bb5cc63ef15ece861a185461be2daa19c82f75f5

  • SHA256

    2c2c5ea09fe6d23ec5a01adf608d58040f97fa65682ff72bbad31991f2c3e75d

  • SHA512

    6b61606365458508a3dd8c39a691b66a6dbf8043786a4ddeaf8aac0f74b6c9c762bc4eb3f3d879278e40d27b8c81112b0e13ee37aeaed9f521bd67e65eae1cc9

  • SSDEEP

    1536:fbJd/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVior93DJQXp3ZRsjcU0K3h:fnZTkLfhjFSiO3onaRsjkK

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      1052-67-0x0000000000400000-0x0000000000422000-memory.dmp

    • Size

      136KB

    • MD5

      b118fb3925ee0988963731f47d9839be

    • SHA1

      bb5cc63ef15ece861a185461be2daa19c82f75f5

    • SHA256

      2c2c5ea09fe6d23ec5a01adf608d58040f97fa65682ff72bbad31991f2c3e75d

    • SHA512

      6b61606365458508a3dd8c39a691b66a6dbf8043786a4ddeaf8aac0f74b6c9c762bc4eb3f3d879278e40d27b8c81112b0e13ee37aeaed9f521bd67e65eae1cc9

    • SSDEEP

      1536:fbJd/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVior93DJQXp3ZRsjcU0K3h:fnZTkLfhjFSiO3onaRsjkK

    Score
    10/10
    stormkittycollectionstealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks