stormkitty | HasBySayaa[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

HasBySayaa.exe
Size

62KB
MD5

04386f595f64443ed036179bbdc59d75
SHA1

d085312d9cbd3d96ed1ea8cc08cbe940c2f4e81e
SHA256

43e9d8a464d478a0d49cba1eae813d83a68085836098a605f7f94f9cae13fe52
SHA512

3b837a95018f2ea1fcda49d032f33d09fc96322585cc09812f15f8603554fba0ef0ecfae14db605456805ace425218fbdaff1484030f98f666b40ebf2acf415b
SSDEEP

1536:NB3ftGHBsnUmwLBcc2FCXdtGV6Lh94HDU:NhkBsnUmwLrZBLh94HDU

Score

10^/10

stormkitty

Malware Config

Signatures

StormKitty payload 1 IoCs

resource	yara_rule
sample	family_stormkitty

Stormkitty family
stormkitty

Files

HasBySayaa.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ