stormkitty | 4959715beadbe94c91806d8f24906ad0f8496a687005638211599ef4aaed12a8 | Triage

Sharing

General

Target

4959715beadbe94c91806d8f24906ad0f8496a687005638211599ef4aaed12a8
Size

1.1MB
Sample

240727-1c5r3szdlm
MD5

c8923afcc78196f3ab2a7dbce7daff28
SHA1

a696a1ea68a0ce45cae51c0dd26a10144bdd0c9e
SHA256

4959715beadbe94c91806d8f24906ad0f8496a687005638211599ef4aaed12a8
SHA512

e779ac622aef234c6cdf240af2e01439f89e1d6963a8e3e764e8c19d02c946f4e25244fd923ada49a5b9bde4d13982218d91e39689eda2b758279682bcc09f1a
SSDEEP

24576:yc1NXaV9x4IUgs36BUI2So5+jnzFoCaGApu8:yq0T+Sk6BU7HIFo7G98

Score

10^/10

stormkitty credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Targets

- Target
  
  4959715beadbe94c91806d8f24906ad0f8496a687005638211599ef4aaed12a8
- Size
  
  1.1MB
- MD5
  
  c8923afcc78196f3ab2a7dbce7daff28
- SHA1
  
  a696a1ea68a0ce45cae51c0dd26a10144bdd0c9e
- SHA256
  
  4959715beadbe94c91806d8f24906ad0f8496a687005638211599ef4aaed12a8
- SHA512
  
  e779ac622aef234c6cdf240af2e01439f89e1d6963a8e3e764e8c19d02c946f4e25244fd923ada49a5b9bde4d13982218d91e39689eda2b758279682bcc09f1a
- SSDEEP
  
  24576:yc1NXaV9x4IUgs36BUI2So5+jnzFoCaGApu8:yq0T+Sk6BU7HIFo7G98
Score

10^/10

stormkitty credential_access discovery persistence privilege_escalation spyware stealer
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

stormkittycredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

behavioral2

stormkittycredential_accessdiscoverypersistenceprivilege_escalationspywarestealer