Extracted

• • Target

    1524-62-0x0000000000400000-0x0000000000427000-memory.dmp

  • Size

    156KB

  • MD5

    adaa5df6436e6fcbbbdf86c71f70520d

  • SHA1

    5e7a077ceed48fe582cfd8dfa19993c82fbb4cd9

  • SHA256

    fe0cd352f59491d4d6b1f87012707d000155bdce1011df3da371054858bc1497

  • SHA512

    980a6182b3f99d682e80ca5e191e7a9d7395aac0bb85e560b0664093d28295e0ab7ed492585ab24ac93dfea5e8d27ed062cba6c10c0885f1382fd48144dfdc1b

  • SSDEEP

    1536:2cLlW/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioqR7ALVy4Vm/bSWCksM:SZTkLfhjFSiO3o47YVrWSWCF

  Score

  10^/10

  stormkittycollectionspywarestealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2