Extracted

• • Target

    224-142-0x0000000000400000-0x0000000000422000-memory.dmp

  • Size

    136KB

  • MD5

    6df013737da07944a035c54be0b8d277

  • SHA1

    5243ec686afc79ef200386b5e6e4ac169db7eee5

  • SHA256

    18ece9865b3675b8174634701d40f210a84bd9ea45f873805a3e76834010e1db

  • SHA512

    9b19478b837aa665716f57d29469aad0adf9654b58a4712271c55cad6b804ca69d4ebeac3b575035c3695626cbfb5cd1f530c8d5ae7ec768f036e26b99e82a33

  • SSDEEP

    1536:9/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioRtkJwhidcIbtTcY:ZZTkLfhjFSiO3orXiWId1

  Score

  10^/10

  stormkittycollectionstealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2