Overview

overview

10

Static

static

3

2025-03-31...er.exe

windows7-x64

1

2025-03-31...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-31_632c3c0bf42250d7dd47818f33b24d4f_frostygoop_ghostlocker_sliver

  • Size

    6.0MB

  • Sample

    250331-jpctdsxrv8

  • MD5

    632c3c0bf42250d7dd47818f33b24d4f

  • SHA1

    f57a0188b0457b03e4cef1c82efdc7e6a9cee3a1

  • SHA256

    ba33703aa30995b74f5c84c97eb3483b624082d1987b059ff88ee5eade2af683

  • SHA512

    206c0982372c2e42af1603d623994581e7338a0c2cce564a1a6b944fe8a3d3bbad815f5b65783e23f129662c0c64943307c3d585dfb5f6dd53a1fc5512b2d642

  • SSDEEP

    98304:MZiPUSI1yOJk+L7xJ6zMA8q33nRsKRABzueL:zUSI1yOiSmz8uRI

Score
10/10
stormkittycollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      2025-03-31_632c3c0bf42250d7dd47818f33b24d4f_frostygoop_ghostlocker_sliver

    • Size

      6.0MB

    • MD5

      632c3c0bf42250d7dd47818f33b24d4f

    • SHA1

      f57a0188b0457b03e4cef1c82efdc7e6a9cee3a1

    • SHA256

      ba33703aa30995b74f5c84c97eb3483b624082d1987b059ff88ee5eade2af683

    • SHA512

      206c0982372c2e42af1603d623994581e7338a0c2cce564a1a6b944fe8a3d3bbad815f5b65783e23f129662c0c64943307c3d585dfb5f6dd53a1fc5512b2d642

    • SSDEEP

      98304:MZiPUSI1yOJk+L7xJ6zMA8q33nRsKRABzueL:zUSI1yOiSmz8uRI

    Score
    10/10
    stormkittycollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Modify Authentication Process

1
T1556

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Authentication Process

1
T1556

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.