stormkitty | 2026-08-06_5605437f572014dede8988ff66488464_amadey_asyncrat_cobalt-strike_elex_glassworm_icedid_infy_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_5605437f572014dede8988ff66488464_amadey_asyncrat_cobalt-strike_elex_glassworm_icedid_infy_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar
Size 11.9MB
Sample260806-wpbmjsxcme
SHA256 45aa9a69958e5237c9cb3c9529b95964d0bdc16d82776197078ac73ef63e0dd3
MD5 5605437f572014dede8988ff66488464
SHA1 67a1d586a49222d61f6a35667ab3211c20320148
SHA512 64b6aedef1d74a68d4f8dd5e66b20678ebe90ac6e5f141886cd444da960a08430deabd476ee909e9e6dfd3fde22aff5b586c945dae587b0946c0038c669a29af
SSDEEP 196608:97FuoY0W8UA5My4urH/P/XRLO/uAqMVVbL72KKmO:NFuEW8Zr4uDXsWAq4tLA
TLSH
T141C6230773822055D17793B8F0C3E7599F7A6E029602C5FB32E238944EBF6D486B2B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer stormkitty

Malware Config

Signatures

Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing Discord tokens regular expressions 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_Discord_Regex

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing credit card regular expressions 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Detects executables referencing many VPN software clients. Observed in infosteslers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_VPN

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Detects executables with interest in wireless interface using netsh 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon

StormKitty payload 1 IoCs

resource	yara_rule
sample	family_stormkitty

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_5605437f572014dede8988ff66488464_amadey_asyncrat_cobalt-strike_elex_glassworm_icedid_infy_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar

File Explorer

2026-08-06_5605437f572014dede8988ff66488464_amadey_asyncrat_cobalt-strike_elex_glassworm_icedid_infy_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar

.exe 11.9MB
ComboMaster.pyc

35KB

2026-08-06_5605437f572014dede8988ff66488464_amadey_asyncrat_cobalt-strike_elex_glassworm_icedid_infy_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar

IMPHASH 9222d372923baed7aa9dfa28449a94ea
SHA256 45aa9a69958e5237c9cb3c9529b95964d0bdc16d82776197078ac73ef63e0dd3
MD5 5605437f572014dede8988ff66488464
SHA1 67a1d586a49222d61f6a35667ab3211c20320148
SHA512 64b6aedef1d74a68d4f8dd5e66b20678ebe90ac6e5f141886cd444da960a08430deabd476ee909e9e6dfd3fde22aff5b586c945dae587b0946c0038c669a29af
SSDEEP 196608:97FuoY0W8UA5My4urH/P/XRLO/uAqMVVbL72KKmO:NFuEW8Zr4uDXsWAq4tLA
TLSH
T141C6230773822055D17793B8F0C3E7599F7A6E029602C5FB32E238944EBF6D486B2B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables containing URLs to raw contents of a Github gist
Detects executables referencing Discord tokens regular expressions
Detects executables referencing Windows vault credential objects. Observed in infostealers
Detects executables referencing credit card regular expressions
Detects executables referencing many VPN software clients. Observed in infosteslers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables using Telegram Chat Bot
Detects executables with interest in wireless interface using netsh
StormKitty payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb

kernel32

CreateFileA FindResourceA FreeLibrary LoadResource WriteFile SizeofResource GetProcAddress LoadLibraryA LockResource EnumResourceNamesA CloseHandle FreeResource GetWindowsDirectoryA OutputDebugStringA GetTempPathA GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW Sleep HeapSize GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW MultiByteToWideChar GetStringTypeW

shell32

ShellExecuteA SHGetSpecialFolderPathA

ComboMaster.pyc

SHA256 4b39928f971c412e67749e745da2a8029832a9b3d0b9d3e75178de7e33c2dee7
MD5 12de2b3a1c2f439f5d13997e319b40de
SHA1 bbb6dfadd23bf36dc7a8d5a1b800790174eb2fcd
SHA512 0694511eb4bf2bab6fdf9a86c4a544d021bcd906937cfd32bff1da7fd3b0523a65ae935cc5c368ba4c4cb6b06dadad9e8f30155ff1506e71b23943c77e8fd8de
SSDEEP 768:iAbYPCSXIISC3yCaTIgTyhw1e2AgoeP1ss1VS3GxwEd9Cb/Gww:iAbYPCSXIISC3yCaTIgTyhw1e2AgovsZ
TLSH
T146F2B50AA8905712FF50F1B550EDC51C93A9AAD2FA62C313B8DD82343FDBAB0DD56358
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables containing URLs to raw contents of a Github gist
Detects executables referencing Discord tokens regular expressions
Detects executables referencing Windows vault credential objects. Observed in infostealers
Detects executables referencing credit card regular expressions
Detects executables referencing many VPN software clients. Observed in infosteslers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables using Telegram Chat Bot
Detects executables with interest in wireless interface using netsh
StormKitty payload