Overview

overview

10

Static

static

1

skin.png

windows7-x64

3

skin.png

windows10-2004-x64

10

Resubmissions

15-10-2024 14:41

241015-r2v5hatgml 10

15-10-2024 14:37

241015-rzckdatfpk 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    skin.png

  • Size

    22KB

  • Sample

    241015-r2v5hatgml

  • MD5

    092276e3abff01e1ccc54ee8613c3568

  • SHA1

    1350e975810d7dc7ca61931dbbe2bbea26f86f55

  • SHA256

    a1e8bde1693c3a1a240515f370757cb441bc9477dcafb53785e11ca175ec8184

  • SHA512

    1d99bc60373459a0fb901085dacacd7e13e9be537e54755658b6fcfe377575bd58b69fda6f873cfbbe28bdbaea8942ea794f12e3c5f90a68b4911630e7767336

  • SSDEEP

    384:E4D/ghg48kC0hVp1hwu8QdHQXiOA+RUNRU8pXQSjLl0CaFyZP20HZ1ju/xY:E/iDkHXhwRQQjRUNRttQglltZP2Wj0+

Score
10/10
stormkittydiscoverystealer

Malware Config

Targets

    • Target

      skin.png

    • Size

      22KB

    • MD5

      092276e3abff01e1ccc54ee8613c3568

    • SHA1

      1350e975810d7dc7ca61931dbbe2bbea26f86f55

    • SHA256

      a1e8bde1693c3a1a240515f370757cb441bc9477dcafb53785e11ca175ec8184

    • SHA512

      1d99bc60373459a0fb901085dacacd7e13e9be537e54755658b6fcfe377575bd58b69fda6f873cfbbe28bdbaea8942ea794f12e3c5f90a68b4911630e7767336

    • SSDEEP

      384:E4D/ghg48kC0hVp1hwu8QdHQXiOA+RUNRU8pXQSjLl0CaFyZP20HZ1ju/xY:E/iDkHXhwRQQjRUNRttQglltZP2Wj0+

    Score
    10/10
    stormkittydiscoverystealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks