Behavioral task
behavioral1
Sample
install_con.exe
Resource
win10v2004-20230915-en
General
-
Target
install_con.bin.zip
-
Size
277KB
-
MD5
65b42bc2ef8b1c5bd761280abbd808a8
-
SHA1
136d3e97f02ee4d435015dbfaaa237072f8eabef
-
SHA256
5628e7d58e3f86ba5598fa0caf0dc81807778c59b456901ffbac5d26d192a11c
-
SHA512
9762de1d2100f4eb53e273c413c2d491737417b7dbd830d9e858094503c585666da77bea0419d0a7c3ded1ea5e508cb7e105f882c77466440647c5c84757cd44
-
SSDEEP
6144:BNGP+t67AWjIKRo62VuLT7+mfA+/fUtVkyFaeDczsk3lnXiJA:rG2/RKRoBAn7lIIIVk0fYzsint
Malware Config
Signatures
-
StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/install_con.bin family_stormkitty -
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_con.bin
Files
-
install_con.bin.zip.zip
Password: infected
-
install_con.bin.exe windows:4 windows x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 277KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ