Overview

overview

10

Static

static

10

NEAS.021ff...c0.exe

windows7-x64

10

NEAS.021ff...c0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.021ff29a9aac258081e5cfdd3bbc3ec0.exe

  • Size

    82KB

  • Sample

    231111-sfhgyshh52

  • MD5

    021ff29a9aac258081e5cfdd3bbc3ec0

  • SHA1

    b1e99f2be97b0e84b812ce3fa78f874ae664e424

  • SHA256

    7b2953d9be9d918e1467cff26e00b4552817e07d21370cb5274db7ca989116eb

  • SHA512

    5544b8cb2cf1a87ec35864f8cab21d7ca1d007fbf4602ec5e90ea584f37fa83b33a1d5689b103be4d8e7ebca1d7e3336353fca4b18f215454f7c07a66617a31f

  • SSDEEP

    1536:fAMfrTX01OrGpRZNdbv66Claewnph6Nu/FJdVmZgAhV2izxOVf9bWNZNxj0kOe+K:aDewnphDFv1izWf9b0Nh0kOeL

Score
10/10
stormkittypersistencestealer

Malware Config

Targets

    • Target

      NEAS.021ff29a9aac258081e5cfdd3bbc3ec0.exe

    • Size

      82KB

    • MD5

      021ff29a9aac258081e5cfdd3bbc3ec0

    • SHA1

      b1e99f2be97b0e84b812ce3fa78f874ae664e424

    • SHA256

      7b2953d9be9d918e1467cff26e00b4552817e07d21370cb5274db7ca989116eb

    • SHA512

      5544b8cb2cf1a87ec35864f8cab21d7ca1d007fbf4602ec5e90ea584f37fa83b33a1d5689b103be4d8e7ebca1d7e3336353fca4b18f215454f7c07a66617a31f

    • SSDEEP

      1536:fAMfrTX01OrGpRZNdbv66Claewnph6Nu/FJdVmZgAhV2izxOVf9bWNZNxj0kOe+K:aDewnphDFv1izWf9b0Nh0kOeL

    Score
    10/10
    stormkittypersistencestealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks