Overview

overview

10

Static

static

3

2025-03-30...er.exe

windows7-x64

1

2025-03-30...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver

  • Size

    21.4MB

  • Sample

    250330-xcbmfswqy5

  • MD5

    759850b1ce1d64533dfea82dcf5c00b3

  • SHA1

    06ef173730c2b389ce26e19c65f27c6fbf6d61b3

  • SHA256

    373d1f853c91d91ca2bc663d3776eefb66189d3c424c683224039d5d6f477099

  • SHA512

    bec70ed7abf337d0318e10f415ab26b0f1ab91e7f26881793617e16c539593d1ea60623dc7fe95ac1155bb778502b74f73428d364e4b5bca672f370128fba110

  • SSDEEP

    393216:XNVguCXVYHSTEUq9D1CvTQ2S9nekuCdQkUkEwmkO77j+vPhwrgxuA:XNVgLXVpT94WQ2S9nvViVkKvj6PHxF

Score
10/10
stormkittycollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver

    • Size

      21.4MB

    • MD5

      759850b1ce1d64533dfea82dcf5c00b3

    • SHA1

      06ef173730c2b389ce26e19c65f27c6fbf6d61b3

    • SHA256

      373d1f853c91d91ca2bc663d3776eefb66189d3c424c683224039d5d6f477099

    • SHA512

      bec70ed7abf337d0318e10f415ab26b0f1ab91e7f26881793617e16c539593d1ea60623dc7fe95ac1155bb778502b74f73428d364e4b5bca672f370128fba110

    • SSDEEP

      393216:XNVguCXVYHSTEUq9D1CvTQ2S9nekuCdQkUkEwmkO77j+vPhwrgxuA:XNVgLXVpT94WQ2S9nvViVkKvj6PHxF

    Score
    10/10
    stormkittycollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Modify Authentication Process

1
T1556

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Authentication Process

1
T1556

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.