Overview

overview

10

Static

static

10

Build.exe

windows7-x64

10

Build.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Build.exe

  • Size

    123KB

  • Sample

    250131-tz97rasqhn

  • MD5

    0575237798a9569b08a53c229b199696

  • SHA1

    218c85fb75a55e152b021d0c7d073fdf82075bf9

  • SHA256

    132e1944cab755a8edbf514d773dc63b65ffc60db4fb0b9b2e0a78833002f63d

  • SHA512

    b17832d7cdc1b48cf46a6923b0f32def2977fde131be34ed70ad6bdf1e3179d45281c418f32ab67d7a7b7acaa71bf5371bbb060fef2f1ca53fc3a9fb58548a62

  • SSDEEP

    3072:en28xnE4SfnDGr7mT4687TFbi9kN72U53TXMmT:KNnE527Ub0bwS

Score
10/10
stormkittycollectiondiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      Build.exe

    • Size

      123KB

    • MD5

      0575237798a9569b08a53c229b199696

    • SHA1

      218c85fb75a55e152b021d0c7d073fdf82075bf9

    • SHA256

      132e1944cab755a8edbf514d773dc63b65ffc60db4fb0b9b2e0a78833002f63d

    • SHA512

      b17832d7cdc1b48cf46a6923b0f32def2977fde131be34ed70ad6bdf1e3179d45281c418f32ab67d7a7b7acaa71bf5371bbb060fef2f1ca53fc3a9fb58548a62

    • SSDEEP

      3072:en28xnE4SfnDGr7mT4687TFbi9kN72U53TXMmT:KNnE527Ub0bwS

    Score
    10/10
    stormkittydiscoverystealercollectionpersistenceprivilege_escalationspyware

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks