Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/r...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://github.com/rombus-PREMIUM/rombus-9-grabber/blob/main/rombus-9-grabber.exe

  • Sample

    241128-nze4qawpcx

Score
10/10
stormkittydiscoverypersistencestealer

Malware Config

Targets

    • Target

      https://github.com/rombus-PREMIUM/rombus-9-grabber/blob/main/rombus-9-grabber.exe

    Score
    10/10
    stormkittydiscoverypersistencestealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks