stormkitty | ProtectPass[.]exe | Triage

Sharing

General

Target

ProtectPass.exe
Size

320KB
MD5

d91ce8584e3ea4ab871df46a5691ad55
SHA1

1a8d835fc8b40731181b71a230837d71fc183e2f
SHA256

75bc18011ab2a39bdd97e241ee748399fa0fdf7fbd51a640abe5067cee34abcc
SHA512

2db75e9d2833a7bd086548f59cf1abc264b7a499382e09e343fa101b953fb390f64ff605e6cdc19423009332bc7cce4a6871f99c6404e6c49e7ecc5c337974ab
SSDEEP

6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvN:3m/Q6P8j/svm1TXI5tZB

Score

10^/10

stormkitty

Malware Config

Signatures

StormKitty payload 1 IoCs

Processes:

resource yara_rule

sample family_stormkitty
Stormkitty family
stormkitty
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

ProtectPass.exe

Files

ProtectPass.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ