Overview

overview

10

Static

static

10

BlitzedGrabber_.exe

windows7-x64

10

BlitzedGrabber_.exe

windows10-2004-x64

10

Resubmissions

30-01-2023 01:35

230130-bzv4qaeb5w 10

30-01-2023 01:30

230130-bws5yscf45 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BlitzedGrabber_.exe

  • Size

    1.4MB

  • Sample

    230130-bws5yscf45

  • MD5

    ea795ffff4c8f24a343102ab0d86c010

  • SHA1

    0a0dd7abf548567caccc32fd06a6f45790ffd1d4

  • SHA256

    a4fad46b0ab068cb7e5de1f3e970101ff2501c5b0608ada10442bcf891c5f8bb

  • SHA512

    b3f8428226e3e23febdd5f6b08f4a788cb62cc1795627b39660fafdbb810c4c7239c29f8833dbc3431a0559591958d0b2f68f36b3be065bdaa122f55666c8ae3

  • SSDEEP

    24576:/40iMngrdePNzQ0ZIxNXaV9x4IUgs36BUI2So5+jnzFYCaGApu8:AsgReFs0ZM0T+Sk6BU7HIFY7G98

Score
10/10
stormkittypersistencespywarestealer

Malware Config

Targets

    • Target

      BlitzedGrabber_.exe

    • Size

      1.4MB

    • MD5

      ea795ffff4c8f24a343102ab0d86c010

    • SHA1

      0a0dd7abf548567caccc32fd06a6f45790ffd1d4

    • SHA256

      a4fad46b0ab068cb7e5de1f3e970101ff2501c5b0608ada10442bcf891c5f8bb

    • SHA512

      b3f8428226e3e23febdd5f6b08f4a788cb62cc1795627b39660fafdbb810c4c7239c29f8833dbc3431a0559591958d0b2f68f36b3be065bdaa122f55666c8ae3

    • SSDEEP

      24576:/40iMngrdePNzQ0ZIxNXaV9x4IUgs36BUI2So5+jnzFYCaGApu8:AsgReFs0ZM0T+Sk6BU7HIFY7G98

    Score
    10/10
    stormkittypersistencespywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks