C:\projects\colorful-console\src\Colorful.Console\obj\Debug\net46\Colorful.Console.pdb
Behavioral task
behavioral1
Sample
Azure checker FullCap.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Azure checker FullCap.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Colorful.Console.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Colorful.Console.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Leaf.xNet.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Leaf.xNet.dll
Resource
win10v2004-20240221-en
General
-
Target
AzureChecker.zip
-
Size
2.1MB
-
MD5
a675480d1ab9b176835d1d37931eb65f
-
SHA1
871da99c0fb930fe9a5410bf9557acc2d5027a33
-
SHA256
2587d1972f2193c70a3961b14d8eb41632f6d90c7d029cdb813f6114e6053858
-
SHA512
e0306a7a6cfb3800d9f72861fc619bcfe0d09a956192daa9984a10b81769d158fe1817e1b5e91eb22f9a52c89016b1eee52663c18554967eaabf33edc42ba215
-
SSDEEP
49152:M9q1xZZGy690F6T2sPR2RfDM/TeaIGfpif3ixoWL2v:iyw0ETDKfQevaPLM
Malware Config
Signatures
-
StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/Azure checker FullCap.exe family_stormkitty -
Stormkitty family
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Azure checker FullCap.exe unpack001/Colorful.Console.dll unpack001/Leaf.xNet.dll
Files
-
AzureChecker.zip.zip
-
Azure checker FullCap.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Colorful.Console.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 980B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Leaf.xNet.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net45\Leaf.xNet.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ