Behavioral task
behavioral1
Sample
r163uG0XxKTfeq3Bw5HAFeXZXk-KaaerIjWC8H8AAtE.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
r163uG0XxKTfeq3Bw5HAFeXZXk-KaaerIjWC8H8AAtE.exe
Resource
win10v2004-20230703-en
General
-
Target
r163uG0XxKTfeq3Bw5HAFeXZXk-KaaerIjWC8H8AAtE.bin
-
Size
121KB
-
MD5
7e27d4a685f428efc340e7a80e978a5d
-
SHA1
e10ddd22bbff1ed0ace9d07a4a543f1350c3d66e
-
SHA256
af5eb7b86d17c4a4df7aadc1c391c015e5d95e4fca69a7ab223582f07f0002d1
-
SHA512
b8acc174c239dfba5335cc5bfdd129dc59084a3a0d76a27c724e440453fc2b5d0e09c97f5c180f011132ffded9aba44b75c5c94c0573c72dd412559e1c911a19
-
SSDEEP
1536:nX/vUgPZC1U23x3BcoEQ7TXyU88Im7c/XusGA9bAI1ozoEXiLDU6pUbMUik:nPvUlK23B7G4K/XusN9b9IiLDU6pUbz
Malware Config
Signatures
-
StormKitty payload 1 IoCs
resource yara_rule sample family_stormkitty -
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource r163uG0XxKTfeq3Bw5HAFeXZXk-KaaerIjWC8H8AAtE.bin
Files
-
r163uG0XxKTfeq3Bw5HAFeXZXk-KaaerIjWC8H8AAtE.bin.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ