General

  • Target

    7f89e0d7af8a5d3aac55f8e431a7155d

  • Size

    561KB

  • Sample

    240129-lxhqqagffk

  • MD5

    7f89e0d7af8a5d3aac55f8e431a7155d

  • SHA1

    e29ae62587d7f6bdd6a0c35b644a2ffd9f256275

  • SHA256

    af06048a49faa8cc34dfc217cea2064b98e6776d4708d9d6f0d7c0c926ff3105

  • SHA512

    def763a9ac715e9443d5afcac7bd8f3028ffa97f19766158fd3e5cdf710b7379182b18529858751422fc46cee79cfe90ade995d73f8e68b92fb560416450def3

  • SSDEEP

    12288:GfX25krtcNSYIgaqmkllWvxgRs0QYst8Lny2Z7ECwfHP9Mkp/Km3fyBGme2:GfX25krtcNSYIgdu704a1/+/0Gmt

Malware Config

Targets

    • Target

      7f89e0d7af8a5d3aac55f8e431a7155d

    • Size

      561KB

    • MD5

      7f89e0d7af8a5d3aac55f8e431a7155d

    • SHA1

      e29ae62587d7f6bdd6a0c35b644a2ffd9f256275

    • SHA256

      af06048a49faa8cc34dfc217cea2064b98e6776d4708d9d6f0d7c0c926ff3105

    • SHA512

      def763a9ac715e9443d5afcac7bd8f3028ffa97f19766158fd3e5cdf710b7379182b18529858751422fc46cee79cfe90ade995d73f8e68b92fb560416450def3

    • SSDEEP

      12288:GfX25krtcNSYIgaqmkllWvxgRs0QYst8Lny2Z7ECwfHP9Mkp/Km3fyBGme2:GfX25krtcNSYIgdu704a1/+/0Gmt

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • A310logger Executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks