e8e9bbaa922bdf2f65250dca73240df8769b651ff715a54802f908144ba0d5e9

General

Target
KittiesCraft_Setup.7z
Size 84.4MB
Sample260710-qs53nscw2w
SHA256 e8e9bbaa922bdf2f65250dca73240df8769b651ff715a54802f908144ba0d5e9
MD5 5b1d1ac8a86c03612f5da5d7aae6199c
SHA1 859fccb7af54101d94fcdbea079ec9a67cf943bb
SHA512 b3a19ee81f70081c7741f16602348059ef4973b1b706936eb36f08df54a31febfbd0e7f677f5f8a449c74649e98da0dff6a5d70a21860b9dae77a52123f21b1f
SSDEEP 1572864:uBVGtZOAqIXDzadNuKf/LONBLWwG7ZdKaIE6pLvm3EBg2tIOAQ9PnIsM:unGtgADWdN//SbGdxt6pLNBptIOAuPc
TLSH
T1331833A4EC930C92C2C098AF196C056F43F89773DA93FA48C67D32BDA693DF46529147
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  KittiesCraft_Setup.exe
- Size 84.7MB
- SHA256 452f336a228be6d9c12bc1e941f9a465a0689702b32e623e6bc6c5efb8ec70c2
- MD5 533452909ef09c96b4a105228cf9cc04
- SHA1 bd1db699adc81a3f1006a61d4fb2bf7563058de1
- SHA512 d280b3e9af402e67118f73a4b4a9ebc5f296db1784cec0f28bcff17646cd574c6fca2a538b25fc5a334b63c8b62b453c290e4162df9ee719c5983f44c176f4ea
- SSDEEP 1572864:gE2um4Ndc29WZRIuVxg5CFZtJttVyt7UQnhoD/NzsUGvPmlQSnUnmKO8:gETm4P2ZWuV+CH1yVN6D/NYvelQSnmmk
- TLSH
  T1AF183394AF920C72F1C4D87B3B5806BE52BAEF7185D2B9588B6C317960729F454F802F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  KittiesCraft.exe
- Size 169.1MB
- SHA256 0297b7a1c483329e0b179adaef07a1ebd4a5034251c59591dbaca2313f24d5b2
- MD5 75e8117a8ee9782eadda94e93187750c
- SHA1 9f3d62317b17af4ddaea835aa35defa18ef98848
- SHA512 288cfc99cfbbc481ccf5d5b4d24ae084b5c503bdf43a81844441160097b43d2f1aee16af326de1d8b4b55a5782cfc6fbf58fa0eb2a4410779262363688ad3ac6
- SSDEEP 1572864:bMw5SJUgPbksdRW8YcrVEGPv/fNsYCdwl0KWCfLM14GYoQt0imGWgyTpQGa:vunRK2agyVQ1
- TLSH
  T18C888C13E39A50E9E00DD1B187879233EA72B8494728B6DF2A5447563F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral2