Overview

overview

10

Static

static

3

cc606f58d3...18.exe

windows7-x64

10

cc606f58d3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc606f58d32942ddd8613c691824dbc8_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240831-hhdxfa1ank

  • MD5

    cc606f58d32942ddd8613c691824dbc8

  • SHA1

    869824ea2fab972f5f10e78463ff4869b019dc0d

  • SHA256

    38d352324a2ca353e1e4c424f303faac518863f0b9c255d90b273cfba24a9cb1

  • SHA512

    ec3f2f2809ad60b92e671b27a64dde7cd229c6d68a7f921823020061b6ed619aa99f64a80036f9057b00da6236ef22b15bc5aa6acf3e6606c06917305d3f4687

  • SSDEEP

    24576:w1jPxRbIuwC9zBldHz90/6iFcQOm8gHLCquAJ5bwWkREx/G:U7suwwT90XF9OmPH2qZPbRwEx

Score
10/10
stormkittycollectioncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      cc606f58d32942ddd8613c691824dbc8_JaffaCakes118

    • Size

      1.3MB

    • MD5

      cc606f58d32942ddd8613c691824dbc8

    • SHA1

      869824ea2fab972f5f10e78463ff4869b019dc0d

    • SHA256

      38d352324a2ca353e1e4c424f303faac518863f0b9c255d90b273cfba24a9cb1

    • SHA512

      ec3f2f2809ad60b92e671b27a64dde7cd229c6d68a7f921823020061b6ed619aa99f64a80036f9057b00da6236ef22b15bc5aa6acf3e6606c06917305d3f4687

    • SSDEEP

      24576:w1jPxRbIuwC9zBldHz90/6iFcQOm8gHLCquAJ5bwWkREx/G:U7suwwT90XF9OmPH2qZPbRwEx

    Score
    10/10
    stormkittycollectioncredential_accessdiscoveryspywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks