Extracted

• • Target

    764-67-0x0000000000400000-0x0000000000424000-memory.dmp

  • Size

    144KB

  • MD5

    14c657f71a5f49e43784c5e421c6f6b3

  • SHA1

    e4b622ac581ddb765df6bb5fcca47e6783658a7f

  • SHA256

    38092921cc69bb5b7cb9a5edd3283616a0f80a3a29e5a536e705dd1b12cd6838

  • SHA512

    1eb0c493c1a4f8a973dda00a8e08ae98cb408226a4ff215117a66cab87148272f34f1eb5cb4072bbf58435d0d91f60e64c07e809b11c72541f15751faa3e92bb

  • SSDEEP

    1536:fSV/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoViow8KLNH7auPyzjbu:feZTkLfhjFSiO3omBNWuaz/

  Score

  10^/10

  stormkittycollectionstealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2