stormkitty

General

Target

XClient.exe
Size

61KB
Sample

231114-1rr5jaga96
MD5

6be4a7c074dc461c8c9e74bedaf5c41d
SHA1

0535964d5cf5e58c7608722d65767c9a33bda831
SHA256

c3e67eaa81c08b734fd310644df2e2777e86fb89e37eeaa5a5f542528f4cf4f3
SHA512

d488d4656709a49a680260c7db653744795d5050f5eaa4449e2aa214056f2a5bb89c66a3e87a23aba9f42582ff2a03d7d11be32333ffe22591dc23b8d1227d6c
SSDEEP

1536:1Zhz2/YIkg4dbxkbZqxwmAi+6zwoOUSBJX3:1ZhAYIkgobxkbZFiTOUcJn

Score

10^/10

Malware Config

Targets

- Target
  
  XClient.exe
- Size
  
  61KB
- MD5
  
  6be4a7c074dc461c8c9e74bedaf5c41d
- SHA1
  
  0535964d5cf5e58c7608722d65767c9a33bda831
- SHA256
  
  c3e67eaa81c08b734fd310644df2e2777e86fb89e37eeaa5a5f542528f4cf4f3
- SHA512
  
  d488d4656709a49a680260c7db653744795d5050f5eaa4449e2aa214056f2a5bb89c66a3e87a23aba9f42582ff2a03d7d11be32333ffe22591dc23b8d1227d6c
- SSDEEP
  
  1536:1Zhz2/YIkg4dbxkbZqxwmAi+6zwoOUSBJX3:1ZhAYIkgobxkbZFiTOUcJn
Score

10^/10

stormkitty evasion persistence ransomware spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1