General

  • Target

    04.exe

  • Size

    310KB

  • Sample

    230322-ry481ahc97

  • MD5

    0443c3768dca6ea9419f767010c6d81e

  • SHA1

    74ccd8aa523196622935ab9ebc16bf2fdffee925

  • SHA256

    2db66ebbd69fe69cc70dea0f98926942f4585dd37cdd13eb4d9232697fffecc6

  • SHA512

    515c5765a237a3f510323f930f56fa2be20c5ef8c4e94c2c1915ea1b4e8cbac06d30511f76614ae9da948c028aa1fe8130b6ddd16a808ce4588fd60d40523a52

  • SSDEEP

    6144:NLbzaxqIKiP92WnTHuGI2esp2mtMviKdrmJR5tkhjMOBQmUElN:dbza19c0LHNzp2mtEiUrmMXQmb

Malware Config

Targets

    • Target

      04.exe

    • Size

      310KB

    • MD5

      0443c3768dca6ea9419f767010c6d81e

    • SHA1

      74ccd8aa523196622935ab9ebc16bf2fdffee925

    • SHA256

      2db66ebbd69fe69cc70dea0f98926942f4585dd37cdd13eb4d9232697fffecc6

    • SHA512

      515c5765a237a3f510323f930f56fa2be20c5ef8c4e94c2c1915ea1b4e8cbac06d30511f76614ae9da948c028aa1fe8130b6ddd16a808ce4588fd60d40523a52

    • SSDEEP

      6144:NLbzaxqIKiP92WnTHuGI2esp2mtMviKdrmJR5tkhjMOBQmUElN:dbza19c0LHNzp2mtEiUrmMXQmb

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Downloads MZ/PE file

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Web Service

1
T1102

Tasks