Overview

overview

10

Static

static

10

PcFire.exe

windows7-x64

10

PcFire.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PcFire.exe

  • Size

    74KB

  • Sample

    241123-rtxy5awpd1

  • MD5

    5869edd76793fdda010c3191d14a38af

  • SHA1

    aacad694e1334c037e68db2201173a8347afff78

  • SHA256

    9b1e17bfb91e74ba74e0b00fba0fa0c71316994cca8145207f3dd0f0e41f1ed5

  • SHA512

    3a0cf7e4d6315ca2be833336f579d1d421d03dda2adcf5fc02ee8880bbb4251b8544528e5bc0c0598447dac49dd6dfb357f42b7bab55ecc792e6f82334091d82

  • SSDEEP

    1536:fZno9xptw8VGHE1uWdas6vKPHvfpK3INcwqE49aSvwKxjzxt6e:f+bZPfpK3qDqP9aSvwKhzxtz

Score
10/10
stormkittypersistencestealer

Malware Config

Targets

    • Target

      PcFire.exe

    • Size

      74KB

    • MD5

      5869edd76793fdda010c3191d14a38af

    • SHA1

      aacad694e1334c037e68db2201173a8347afff78

    • SHA256

      9b1e17bfb91e74ba74e0b00fba0fa0c71316994cca8145207f3dd0f0e41f1ed5

    • SHA512

      3a0cf7e4d6315ca2be833336f579d1d421d03dda2adcf5fc02ee8880bbb4251b8544528e5bc0c0598447dac49dd6dfb357f42b7bab55ecc792e6f82334091d82

    • SSDEEP

      1536:fZno9xptw8VGHE1uWdas6vKPHvfpK3INcwqE49aSvwKxjzxt6e:f+bZPfpK3qDqP9aSvwKhzxtz

    Score
    10/10
    stormkittypersistencestealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks