Extracted

• • Target

    2036-61-0x0000000000400000-0x0000000000427000-memory.dmp

  • Size

    156KB

  • MD5

    db6bdd3c84ccc3f0815685330e2c38b6

  • SHA1

    086d30ace85367c5dac28577afcd9622793a9517

  • SHA256

    440d58456e2ad7a47bb3f259233b1e194af04b6bc00c0ae5ec7d9d776f58c43c

  • SHA512

    bfd5360ef862fe06b4317e3e3b42cbb59906fc73dc2e179ce86682398908bfa67bc13ae5cc1984dc0016cc62c491ea4d2d9fceed16562e78ea7ce23533678e60

  • SSDEEP

    1536:ep/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioUfW0Sou0WcWK22m7kqD:wZTkLfhjFSiO3oQ5Sou02Kb0/

  Score

  10^/10

  stormkittycollectionspywarestealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2