stormkitty

General

Target
f906668bf46889d0a78b4d207ae34a6442b4c98b23055cac9a0715e671ca6b31
Size 1.0MB
Sample241228-yp65ka1rer
SHA256 f906668bf46889d0a78b4d207ae34a6442b4c98b23055cac9a0715e671ca6b31
MD5 c78e19b1b79ef2cbed3428f6d055a217
SHA1 34e1cca94e8a5dfee7825951e8d7d103fe24a94a
SHA512 e0828b3c2e2e060ef79855de7bb3bf297ba1590b6f08784ad85cd19c090e84d5a50893a1d89a70aea13d48f7896b62d048447e7eb40a23ae8309f5207642470a
SSDEEP 24576:qnsJ39LyjbJkQFMhmC+6GD9c0P8j/svqA9:qnsHyjtk2MYC5GDzP8j/Mq2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  f906668bf46889d0a78b4d207ae34a6442b4c98b23055cac9a0715e671ca6b31
- Size 1.0MB
- SHA256 f906668bf46889d0a78b4d207ae34a6442b4c98b23055cac9a0715e671ca6b31
- MD5 c78e19b1b79ef2cbed3428f6d055a217
- SHA1 34e1cca94e8a5dfee7825951e8d7d103fe24a94a
- SHA512 e0828b3c2e2e060ef79855de7bb3bf297ba1590b6f08784ad85cd19c090e84d5a50893a1d89a70aea13d48f7896b62d048447e7eb40a23ae8309f5207642470a
- SSDEEP 24576:qnsJ39LyjbJkQFMhmC+6GD9c0P8j/svqA9:qnsHyjtk2MYC5GDzP8j/Mq2
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stormkitty xred backdoor collection discovery persistence spyware stealer
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Stormkitty family
  stormkitty
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2