Extracted

• • Target

    4404-174-0x0000000000400000-0x0000000000422000-memory.dmp

  • Size

    136KB

  • MD5

    2dc19f3fa4ee28fec3ec33684d4e7063

  • SHA1

    fd98918f8a26b73424459aab9cc4f83401a0e325

  • SHA256

    644f959d3c5ef1bea63eadb769d87a773ad66f41a9b27ffa42ae7847ca43e149

  • SHA512

    7d61690877cc6535f38e5900631488cd879ccbdc7cc2fbe817fef076bb416590c898d196eeaceef952669faa146203b25853609607417767c34881b315886356

  • SSDEEP

    1536:7M/w/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioZkcOqJ40eZgYAv:7M0ZTkLfhjFSiO3o3kcqZZG

  Score

  10^/10

  stormkittycollectionstealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2