Overview

overview

10

Static

static

10

0da1abdcce...18.exe

windows7-x64

10

0da1abdcce...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0da1abdccef71f074faeb911cafb3a9f_JaffaCakes118

  • Size

    307KB

  • Sample

    240728-hrdm2axdld

  • MD5

    0da1abdccef71f074faeb911cafb3a9f

  • SHA1

    c2ed5ff2cd60e7e6193d8f934fce03ceab2f70e2

  • SHA256

    87bcf35d7135ecbc956554098f411ef9bf7d20d0a7905442d2417f422d7479b3

  • SHA512

    7ac7343f175566a10efa2ecaa0700af2671db07ee052727bdb6c6628d77d4a76f63f858b5e77af6f4eaefebfb592c8ba04b185605a9f6a8f5eb837a74ad6348c

  • SSDEEP

    6144:orRt89VZUMTllWjhwuGFXY5mJwpT6jlpVDpPPAu6AkHrW5Tp3PakxMJdE2:orXsZ7TP04I5mCpWjbAu5kQdyk6

Score
10/10
stormkittystealer

Malware Config

Targets

    • Target

      0da1abdccef71f074faeb911cafb3a9f_JaffaCakes118

    • Size

      307KB

    • MD5

      0da1abdccef71f074faeb911cafb3a9f

    • SHA1

      c2ed5ff2cd60e7e6193d8f934fce03ceab2f70e2

    • SHA256

      87bcf35d7135ecbc956554098f411ef9bf7d20d0a7905442d2417f422d7479b3

    • SHA512

      7ac7343f175566a10efa2ecaa0700af2671db07ee052727bdb6c6628d77d4a76f63f858b5e77af6f4eaefebfb592c8ba04b185605a9f6a8f5eb837a74ad6348c

    • SSDEEP

      6144:orRt89VZUMTllWjhwuGFXY5mJwpT6jlpVDpPPAu6AkHrW5Tp3PakxMJdE2:orXsZ7TP04I5mCpWjbAu5kQdyk6

    Score
    10/10
    stormkittystealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks