Extracted

• • Target

    palmicc.exe

  • Size

    144KB

  • MD5

    21080c64225c8f730626c293703cc378

  • SHA1

    574eb72eefc0264c2149daae53fd26c5494b6071

  • SHA256

    5fcd4e3a9fcbd19f89d73919311d52abdcf95994123942ac533e60a9f198e1d6

  • SHA512

    1114cdbd08afba2798a61c3b600a0781290bea0497c243e97bc27f0983627e98e0452df1640f7799c184fe0d57a9e5199f37edc10208e9b37cb6a9555f3b2942

  • SSDEEP

    1536:r65/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioOO4yX5t4l7yYipCa:r69ZTkLfhjFSiO3ocO4yX34lmYg9

  Score

  10^/10

  stormkittycollectionspywarestealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2