stormkitty | 122b408957627df7b1592b0bd391c82e[.]bin

resource	yara_rule
static1/unpack001/Discord-Raid-Tool-Box-main/PussyKiller.exe	disable_win_def

resource	yara_rule
static1/unpack001/Discord-Raid-Tool-Box-main/PussyKiller.exe	family_stormkitty

resource
unpack001/Discord-Raid-Tool-Box-main/PussyKiller.exe

122b408957627df7b1592b0bd391c82e.bin

SHA256 d633cf3249a08f878a33ef419131e8affd85600923170109317906cefeb1e62f
MD5 122b408957627df7b1592b0bd391c82e
SHA1 cd6dddcd14662acc98bb702f6488ee1ccc7c1879
SHA512 a65e29079b0ecae9ed89b2d01c11c05a5e53d7feadeff8442ea78b7159ffe108614ab4d80f3da485a8a5aa254f2215badfe69004dec59cdcfe4ce1777ab4f10a
SSDEEP 768:G6p4oc5XfYhNG7Jp6xjXBetoNd2Oyp6ZUeASJCL16J8ihDi2dO6sMj:GATsXfbp6NXBba6ZUe9JCh6Jh4sOnMj
MD5 SHA1 SHA512 SSDEEP

Password

infected

Discord-Raid-Tool-Box-main/PussyKiller.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 736f8b467d09e4805d336c56b49ec183355dc433e04b93904d2e8d5876d5b9de
MD5 7acd7ca811c678a92d62d556cae858dc
SHA1 b05d0fd47d2d905234db53614f725e3744c93b3e
SHA512 24fe70950fc092d9de383f5c80c70bdc4bd5e342b927e2fb495752e0036c3d2eb0547f60467ef5019a686fffd2f8057105d13dd566172f9438ffe4434748166b
SSDEEP 1536:rNtW7bvrmSbUMiuidaw6v3ZfXR6/A8Id0FWGV09auvIUxjFxtbm:rzTyXRKA8Iwg9auvIUhFxty
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

81118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Discord-Raid-Tool-Box-main/README.md

SHA256 5f42507b1aae6396f6541f7415e4f0b7a6ca3db1081e126c5af544e6997a5001
MD5 d95f21a05112284742b9d600d227e589
SHA1 eb4e813b714a851b70c18307113ee193944c86be
SHA512 45b9f7aa09a3f2a6d6662353752778c398325ba0a76c96d4ba590cccecab06b17c51d027f5d079804bc195800d3d33cb16010d747809c406734a90ae96e905c2
MD5 SHA1 SHA512

Discord-Raid-Tool-Box-main/grab.txt

SHA256 9cfe34f70b73978c35a4518324121a2aed35116f89563d73b00965f9762d2c00
MD5 e2ebaa850ede07d140a0bf248b8b38c2
SHA1 3dfa71b369e9827e95a741bfdefe774fa3b3d781
SHA512 d6f5cdb230f8a426e5f83e16da737df27f8b6b47b604b57656608e66fba3836e2fb3e862a0356dfe55d9563039cc127e4b01b5dd799603e916d97367df14e676
MD5 SHA1 SHA512

Discord-Raid-Tool-Box-main/proxies.txt

SHA256 0f2818b69ffc309e962903366d0d02b730fb77bbca8a2940d09b3316394fcc11
MD5 d5e1ceb9827851541029efcc0d6484c3
SHA1 438022b6955eaa0bdb41978015d1f16a342b63c6
SHA512 dfbb75c260afe3ecdbe24801d81891b8bf0913070d4a39202beb664bf7df83954b7ff06277c220a4bc7764c1de28adfb537ec1ab2da7fc5909b1781c41f29c80
MD5 SHA1 SHA512

Discord-Raid-Tool-Box-main/staff/channels.txt

SHA256 f2d7602738c461075c738170b60306cfd23c15bd1cccab028d5632c6604c66b2
MD5 5e092f28851e7fe58972d71449b2a128
SHA1 b426baf0180cf41a6b47b1df5f72c895af09ada9
SHA512 97c0a393e02b5e6bf7861b66e19bbacb71bac6fa6be054a9d019aeebda4d981882113be282160585d929018622bb8b4ac1ede4387a031b29220eeec63bfad011
MD5 SHA1 SHA512

Discord-Raid-Tool-Box-main/staff/groups.txt

SHA256 b288265b6e8199efd6f8f8fcc202fc44949e9eda1690120955a1c812fd4d94c3
MD5 1c5483db2deb67685547b41ae6249c5a
SHA1 4fdf7ea90b03f5e15a552a6b272a44393a875aff
SHA512 0fcfd364699a354e2ef4a792a9dfba889cf3db35a017f42f237547b50ba0a8209700abb12beda64c90b18d2dc7c4a8b5cf34c37bdb34fac3f62911aced007dec
MD5 SHA1 SHA512

Discord-Raid-Tool-Box-main/staff/massdm_IDs.txt

SHA256 b5db0ec0a287bb7e4e517cc34c7b9db00b89764333f58f6403f8df2077f74246
MD5 dbc7d05b98ae4197c2f81393563454e0
SHA1 e1fcc6cbf2e6563e485a68396b33fe80475c57d4
SHA512 85814249cda5e40338dc078f1775276a554735df0f76d6e6d70c1746b7f215b826d6867cc576d44b58a9228bc3990af7b4246702e481dc60a5968c299216157b
MD5 SHA1 SHA512

Discord-Raid-Tool-Box-main/staff/roles.txt

SHA256 c727687000c1fd81ab6c9f70ad229c99680eccb65212c6863cf286517249dd0b
MD5 e80807415941fe0a2e2b4b6c51447863
SHA1 d6ca7ebab142746a04b657036e301cf78f97c18e
SHA512 f8f81593a524b0e87efe0faebdd822c9bb5477760a5ad4486b64241f5addf55ad8d6039257ba0fd47967ddc514eb6689f7aa26e0d66bb830933014826bcf6416
MD5 SHA1 SHA512

Discord-Raid-Tool-Box-main/staff/users.txt

SHA256 e0a0d73e7f1f1622ee71506de684f46ab50ce470b4a2b2f65ed98800e04f313f
MD5 caa700d5b384430350358f83cd320b95
SHA1 d82271b33bb5fe868a658143e85f6d5d1ab6f364
SHA512 748084cecbdc8fa313cb9d386c8ef40830f4631d290465453728fd18b1428084d43f6d53eec94f61c70ee9dcfa445c65b45b43059c1d5ffa37e8de5e5b441e80
MD5 SHA1 SHA512

122b408957627df7b1592b0bd391c82e.bin

Discord-Raid-Tool-Box-main/PussyKiller.exe

mscoree

dotnet

Discord-Raid-Tool-Box-main/README.md

Discord-Raid-Tool-Box-main/grab.txt

Discord-Raid-Tool-Box-main/proxies.txt

Discord-Raid-Tool-Box-main/staff/channels.txt

Discord-Raid-Tool-Box-main/staff/groups.txt

Discord-Raid-Tool-Box-main/staff/massdm_IDs.txt

Discord-Raid-Tool-Box-main/staff/roles.txt

Discord-Raid-Tool-Box-main/staff/users.txt

Sharing

General

Malware Config

Signatures

File Explorer

122b408957627df7b1592b0bd391c82e.bin

Discord-Raid-Tool-Box-main/PussyKiller.exe

mscoree

dotnet

Discord-Raid-Tool-Box-main/README.md

Discord-Raid-Tool-Box-main/grab.txt

Discord-Raid-Tool-Box-main/proxies.txt

Discord-Raid-Tool-Box-main/staff/channels.txt

Discord-Raid-Tool-Box-main/staff/groups.txt

Discord-Raid-Tool-Box-main/staff/massdm_IDs.txt

Discord-Raid-Tool-Box-main/staff/roles.txt

Discord-Raid-Tool-Box-main/staff/users.txt