stormkitty

Resubmissions

02/08/2024, 17:51

240802-we61pstdlq10

02/08/2024, 17:49

240802-wege2stdjp3

Sharing

Copy URL Twitter E-mail

General

Target
DiscordMulty.rar
Size 3.7MB
Sample240802-we61pstdlq
SHA256 46e1081372a9209e9bb11225ecfdcd3d3824a51a568c03763e2c689c4ef3928f
MD5 981187d8addde5cbf8186db39a5eb885
SHA1 18acf273a86e61b17c6df24ad988182e80541c6a
SHA512 32606af10a762a7bbb2bbd08def5808dc3817abca24eaee8348cab28c14afd1413339a9ec2adbea75cd242de3d3ae49e3e2cb02ceb782d745013614dbd1ef3ce
SSDEEP 49152:Er8nNFEfeAMLxtndQpcR0EyB4afsHnckkTeql5c4rdFLacfgiL0WaLKYmpldw7:/kOVtgcROFU8k0N59rdMVvWKxSdw7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  DiscordMulty/Colorful.Console.dll
- Size 88KB
- SHA256 6de7e078e24afa66b699c6eaf93988ff44dda8bd062fc11351978ddc5b601899
- MD5 513887befab1824441ab836a1de051e1
- SHA1 737acdf101b06d4f7528a17a361120898dcbd98d
- SHA512 35b63292badf4d79375f32c60ae2993b5f3315203cf790bceba0df69bb222a83b5cb1ff55cea30c48345a59b04c17d037580dd7bcd8c5075334f8bdedf640454
- SSDEEP 1536:3J1J4aE966w/2DtgNpWFbCagAHM9KTC/bu:3C796R/ObCagAs9KTgS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  DiscordMulty/DRouter.exe
- Size 1.9MB
- SHA256 a881c67a5ad97fed46616a1c219a4c70fffcbe3ec1f0c900747e2ba75131b143
- MD5 4d978f4a830f374b5867f1ae53b08ffc
- SHA1 827b301d630a037a6559acc3b63612fded885767
- SHA512 f9339c421b5a8ee85358d0a4384ef3d203cb68572152f02c9610c4c371091d5c5caed5fde3a3c379ef3feaa2c86cc123e09596fb8862816ea60ae2d78d6a6091
- SSDEEP 3072:gq6+ouCpk2mpcWJ0r+QNTBfqcm2GvaDE:gldk1cWQRNTBS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stormkitty discovery stealer
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  DiscordMulty/lib/Anarchy.dll
- Size 529KB
- SHA256 560bbd5b4fd7fca4991ed0bf251883d6d9d1023f59cc1ce364923737b96afcf1
- MD5 8725518ff670fda909532c65e9824844
- SHA1 92cfacf2ff7d0a746064584d920ab4069bc8d2b2
- SHA512 7244bfa09f8fff4f9a73306b1bb13c1751fb973cd163c0848c8fea116bea59f1da7575a5251a4a39b91699c5cac3b2cafd27982c8c3447a6e1587d355068b776
- SSDEEP 6144:P2Tx1CON752DK3NSJXbCxl+Ij9+V+YviOaAgahp5gRNXT/NUdAMVYrTkTVrPV4:23+LdB+zOpd2Nb2IkQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  DiscordMulty/lib/DSharpPlus.CommandsNext.dll
- Size 75KB
- SHA256 c86b413716da6dd0a50348a2bd0166b686e6e61361fe16e8396ff92490e592d5
- MD5 430949bd7700acf32219c4fa4e40557e
- SHA1 f7cfa7f941fc00d204623f7396362f90c6eda262
- SHA512 18ae9b1813b44ccf7644cf21cf4ff157e5e999354f9fc5716ba28300751babff610e5bfccdd1e1deeef0fcb62370bd1bce64e6969b644a3a7200fa870d3c853b
- SSDEEP 1536:Exeas5/d0n9HhCuY13Yx3Fllya7d4lQy2J0r4cJYY:EY5/sK13YxTlBd4libcJYY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  DiscordMulty/lib/DSharpPlus.Interactivity.dll
- Size 45KB
- SHA256 b145b8baa88c1858e32be81ac439cc6852baff784a520345623abaf70f310e7c
- MD5 c71a72037e9e3864409cf7c11a8e0dae
- SHA1 11db0dc975f2e2f7c3c2340efeb690206efd6524
- SHA512 fd59ff5036c51493152c4700ed49c98c6633614b4b3aa91c44b9be3dafc6ec1eafd133b535b262245d5bc464b7482088a5d4c312389f5c3aa9df018287f15b44
- SSDEEP 768:gCLDM0WU1QLLbN+B4dJRxBN/SkYA9x1T2CPiSBUxczMsZv1JzLS1SZu0:rD/ELbgQDS3GTZO+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  DiscordMulty/lib/DSharpPlus.dll
- Size 583KB
- SHA256 ff7127e0d535b02a768f9722852327608e9a6509ad0a767f071c876f3ac66be6
- MD5 6af3eac8e21dca74885ef66a63645b5c
- SHA1 c869c5a45e5e28740727321d909278ae8d17895f
- SHA512 d2f150e772519a50cb44bcd356c7d93421aa511cde1cd011957ae1fdd33fbd1085a91837eec696f3c08bb2886605ffc43b143904d1ca8162ce1d49d1841e3678
- SSDEEP 6144:K075oJI9epDhnRplRdUwPbe9RDpDDDAgDDk5uXvnA3QNV2q:K07B9e51fPqpDDDAgDD7cQ3r
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  DiscordMulty/lib/Discord.REQ.dll
- Size 73KB
- SHA256 61cc7051cd1585a15fe544662d17b50b846fdc0cd21c4eb569649c87687cd45e
- MD5 954db55a18c2e6e01b45668a84418346
- SHA1 d61f6d6139d14290ef6fac35496fcf474887c653
- SHA512 03d6b2f6f6716fdf208145b8a83f04e9bec841d5cbfd8239084296870819e3edac7b8cae25d7d1345bfac18ec4de182871e1f5410a0e3753d5478a5285077f42
- SSDEEP 1536:o4qITAvwWjVxjwYUIUXvir8nh5YKalYGMNpdcZp6XwTO5HVP8GRKhiy6:nAvwWjVx8YUIQRyKalYGMNcj6XwTO5Hj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  DiscordMulty/lib/Figgle.dll
- Size 473KB
- SHA256 ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9
- MD5 7c89d3e9baf0648fb767a70e0eacc35c
- SHA1 6558308ec9d4be79b001c03030401c0e3c9701bc
- SHA512 00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2
- SSDEEP 12288:dwnZ6NqfPaM8r3dFxDxXrxgRX7Jb5oc3Z:SnWqfPaTBDJxgnbJ3Z
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  DiscordMulty/lib/Leaf.xNet.dll
- Size 129KB
- SHA256 de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa
- MD5 ea87f37e78fb9af4bf805f6e958f68f4
- SHA1 89662fed195d7b9d65ab7ba8605a3cd953f2b06a
- SHA512 c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a
- SSDEEP 3072:gE3OJDHIfFLlL3pPiqhcLS/oZhttaMBM2cid:gHWZxJiqO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  DiscordMulty/lib/Microsoft.Bcl.AsyncInterfaces.dll
- Size 20KB
- SHA256 075ce79e84041137c78885b3738c1b5a03547d0ae2a79916e844196a9d0ec1db
- MD5 1ee251645b8a54a116d6d06c83a2bd85
- SHA1 5dbf1534ffbff016cc45559eb5eff3dc4252a522
- SHA512 9f67fd0566eac2da4253d08697daab427e4e85780615d940f086a88424dcbb0563abae7e4824088e64ef7024c1bb3bbf324f2d07bc7ba55f79e4af3c9ea88e97
- SSDEEP 384:69P2wZOXm7YJVHTe+0VJI0vrdaVemxO/f7vWeq/WIdHRN7bg30uw7lGsV9W+:u2zmYrHCV9cIL6TbtCSW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  DiscordMulty/lib/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 43KB
- SHA256 200aba7859ecfb045d43a8e2bf9abce4c929507364b7714388f59affe708fb06
- MD5 7a9b8793552ce40160a6d273b22f807e
- SHA1 1c302ea0a44f517b97af19252140ec710d5d3bfb
- SHA512 7d5ea03d5815a6f5705875fe6c2d2179c6ee5468d6b19423f04c8982e64226e656bfd7ccaf7a5756c7046d2e6d2c3504190ba642e02bc197d48dad9320fd6bd5
- SSDEEP 768:gQnUmCQ0dQ8d2TN7uxgoXvM4s8w0woFY9SP8:MmC3dQ88Tk+8vM2fBO9I8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  DiscordMulty/lib/Microsoft.Extensions.DependencyInjection.dll
- Size 74KB
- SHA256 c85cf85783322abea6532c10f63f7dd6745398ff875486ab869ee542ee731fea
- MD5 43976c7dd59919e767527398d3fd7e01
- SHA1 b7913d30630356b814da0533f126d75e64594849
- SHA512 dd643dff991338dc85a0dcf36b1a14271986f11cd810b64a1924c1752f141c296cd33e932d66aace26a04ff4168710a44507f95f54c96e00eaedce70d42b67b3
- SSDEEP 1536:cNOvcLxIFcvKln7wrSWp+1utn7Q3lFkmidDGwlF0TCOjzrT:cD1Is4mSWp+18Q3lFkm4ETCW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  DiscordMulty/lib/Newtonsoft.Json.dll
- Size 683KB
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  DiscordMulty/lib/Polly.dll
- Size 262KB
- SHA256 12e15418fd0004426ec4280ad31d269ef926b91d58153eea740ce90d6725574a
- MD5 b33a87495e57b6ee55bf9668a943b465
- SHA1 d7864c77b5356bb23a72c56af2efd2ac47478c5a
- SHA512 c97b305aee8b9f4f7b782b9868f1650b1e56f22b5bb8584f65bc6a310f764c16c9148fe8966a9d3267d5c1f1f9d476f895ca459f1743657dc4541d7a9d6d893e
- SSDEEP 3072:081atC3DkYDfflmPS2h5AQO6wSZqDpPeFx:0zcgYD1kp5AQOzSZqVG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  DiscordMulty/lib/System.Collections.Immutable.dll
- Size 238KB
- SHA256 a8e9ce5d4db1897a939e60860154617300b0dfa4c4d3e10341f21af0de4bbfd5
- MD5 aad3b7c5828e16b4c8071e5ad64b3f7d
- SHA1 a9049b07b9f5c9f4c3da4d4568781ba58564b896
- SHA512 5eb044397db450090c41b20b99385c085f5e08d4983bf2bb34f2bf026f6df747b37839ab309846ad1fc1b76519ef77deb28ce4831f8140c9dcdd8fb1700690fb
- SSDEEP 3072:u80xOpWDN5GznPbTl1kCaHa5OcQ60YEQiZVAaI5SBdGO36m2biZkYAoNliuqxEN1:u85ltaHaIcaCiQ55K7aiZ3AM4ER
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  DiscordMulty/lib/System.Interactive.Async.dll
- Size 202KB
- SHA256 30745f077a2370f0695a1e182850b7e1e756d7c8dc708f3be2ddf4e364187d6f
- MD5 dc8ef87098c7d9558bb37d286e845d37
- SHA1 f825c24e9d87333612ed22da77b64555a338e2ec
- SHA512 7ede988f59464e24c6ef9932926c45c5178f013029439f722c0a2c409cba45c8cfc00e5b7d95df8d633a38e22faf445a1730ca93bc2832875b03912b4040c95b
- SSDEEP 3072:cZavR4Kcdd0pH24zQLae8b3w3RdY7Obp8LGfYKssY:6avICHnzQ+e2wh8D
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

StormKitty payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32