Overview

overview

10

Static

static

10

Discord-Ra...er.exe

windows7-x64

10

Discord-Ra...er.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    122b408957627df7b1592b0bd391c82e.bin
  • Size 34KB
  • Sample240806-c9bcqsxcmn
  • SHA256 d633cf3249a08f878a33ef419131e8affd85600923170109317906cefeb1e62f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
stormkittypersistencestealer

Malware Config

Targets

    • Target
      Discord-Raid-Tool-Box-main/PussyKiller.exe
    • Size 74KB
    • SHA256 736f8b467d09e4805d336c56b49ec183355dc433e04b93904d2e8d5876d5b9de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    stormkittypersistencestealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks