stormkitty

General

Target

horrxjddub.exe
Size

107KB
Sample

250212-1d9sesylfn
MD5

9034080ecb301060a2a69519198c3211
SHA1

6c504419d9f1085aefee87ade0300fdd59e5c66a
SHA256

4b25fa167392d8e4365d2f3c787db1c974ccb8fd13d2ad1099b69db1f62c03f7
SHA512

f69967ec3dd0009f5950397a979a2eb4a52a11c62799d89c33abf05c4dfa8542e9c9b3a43a66a631a235f6728522ba373fd15227097d28cc887705474cd75428
SSDEEP

3072:g+RZk7QEyRiBaIOWQ7sR9bGpxReUbpMD:fRZk7DZ8u9bY

Score

10^/10

Malware Config

Targets

- Target
  
  horrxjddub.exe
- Size
  
  107KB
- MD5
  
  9034080ecb301060a2a69519198c3211
- SHA1
  
  6c504419d9f1085aefee87ade0300fdd59e5c66a
- SHA256
  
  4b25fa167392d8e4365d2f3c787db1c974ccb8fd13d2ad1099b69db1f62c03f7
- SHA512
  
  f69967ec3dd0009f5950397a979a2eb4a52a11c62799d89c33abf05c4dfa8542e9c9b3a43a66a631a235f6728522ba373fd15227097d28cc887705474cd75428
- SSDEEP
  
  3072:g+RZk7QEyRiBaIOWQ7sR9bGpxReUbpMD:fRZk7DZ8u9bY
Score

10^/10

stormkitty stealer adware discovery persistence privilege_escalation
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Stormkitty family
  stormkitty
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2