Extracted

• • Target

    Chameleon-Byfronpatch2.exe

  • Size

    9.2MB

  • MD5

    addbf6301c1ea797554a0152da23d5ae

  • SHA1

    01a22ed2bb77ff84546147098348a07bc0eecbc6

  • SHA256

    585c788d34f68b6fdc7695d5752e6450ae5f3e2c7dfd0dabaafefc598b29ecdb

  • SHA512

    9507a56c571d1f9ddf67dd9b5200c340416b00bb956c52fa88b8cd2108d5f789cdf5c04d60aa06c5c9bde8bec2e6a324c89435eec57708e1f66fd0a98c767a11

  • SSDEEP

    98304:NLTHcOdLkG6nUDvQlPU68hkY8LdYwTE/zTPy2R0r:mOdLkG9TChA/zLc

  Score

  10^/10

  thunderkittystealercredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealer

  • ThunderKitty Stealer

    ThunderKitty Stealer is an open-source stealer written in Golang.

    stealerthunderkittystealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  behavioral1