Overview

overview

10

Static

static

10

1c7e395639...38.exe

windows7-x64

10

1c7e395639...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c7e395639d6a3c03cb310ba7f778a38.exe

  • Size

    144KB

  • Sample

    220922-k2qrfseffr

  • MD5

    1c7e395639d6a3c03cb310ba7f778a38

  • SHA1

    4e2547c218da0e3abd1ff1efa3815c8392985521

  • SHA256

    6ddbc2a9b1726f543b1a77c4c676769650b89bed84cd80e7be16b2433a2b3e44

  • SHA512

    75b595c981117277880113c351e674d098f53ac36fa36dc5c1e56601345edcc4979a4fd87bd3c2dbf88ae226374917879721d48de02193031f6c6d598c3f6f13

  • SSDEEP

    1536:e4a/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioTzmM8BdrXX60ksvg:e4yZTkLfhjFSiO3otzHSXc

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      1c7e395639d6a3c03cb310ba7f778a38.exe

    • Size

      144KB

    • MD5

      1c7e395639d6a3c03cb310ba7f778a38

    • SHA1

      4e2547c218da0e3abd1ff1efa3815c8392985521

    • SHA256

      6ddbc2a9b1726f543b1a77c4c676769650b89bed84cd80e7be16b2433a2b3e44

    • SHA512

      75b595c981117277880113c351e674d098f53ac36fa36dc5c1e56601345edcc4979a4fd87bd3c2dbf88ae226374917879721d48de02193031f6c6d598c3f6f13

    • SSDEEP

      1536:e4a/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioTzmM8BdrXX60ksvg:e4yZTkLfhjFSiO3otzHSXc

    Score
    10/10
    stormkittycollectionstealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks