Behavioral task
behavioral1
Sample
cf235bd2c46ce62bcffa21733ada4a8e13a6f2f8d4a88b3f3d3346c5949b5373.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
cf235bd2c46ce62bcffa21733ada4a8e13a6f2f8d4a88b3f3d3346c5949b5373.exe
Resource
win10v2004-20231023-en
General
-
Target
f127b55a763f0b5838378eb8f4b05bab.bin
-
Size
398KB
-
MD5
ccf3a8c6042e844a4157c1468bc259e3
-
SHA1
4318b43cf0df533960e084e09f324e8df9a16c04
-
SHA256
3927bc63d30ce6717ed26ff775ef6252a361bb55556a8afdf71b55b376636d4a
-
SHA512
f1b909b0686e121acc88b57b77fa85300437ae8678a4bf3e3c0ed2b256f4238866f455b322e3c4edcebbad4576f8481e4bc68e81559087190bb885cc458566f8
-
SSDEEP
12288:y3EAny3U3FOu27VWEgoAURzOqmP1aHh7eMzE+bXbWCa:1GKMwu25WxkzOqucxoyW9
Malware Config
Signatures
-
StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/cf235bd2c46ce62bcffa21733ada4a8e13a6f2f8d4a88b3f3d3346c5949b5373.exe family_stormkitty -
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cf235bd2c46ce62bcffa21733ada4a8e13a6f2f8d4a88b3f3d3346c5949b5373.exe
Files
-
f127b55a763f0b5838378eb8f4b05bab.bin.zip
Password: infected
-
cf235bd2c46ce62bcffa21733ada4a8e13a6f2f8d4a88b3f3d3346c5949b5373.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ