Extracted

• • Target
    ba33703aa30995b74f5c84c97eb3483b624082d1987b059ff88ee5eade2af683
  • Size 6.0MB
  • SHA256 ba33703aa30995b74f5c84c97eb3483b624082d1987b059ff88ee5eade2af683
  • MD5 632c3c0bf42250d7dd47818f33b24d4f
  • SHA1 f57a0188b0457b03e4cef1c82efdc7e6a9cee3a1
  • SHA512 206c0982372c2e42af1603d623994581e7338a0c2cce564a1a6b944fe8a3d3bbad815f5b65783e23f129662c0c64943307c3d585dfb5f6dd53a1fc5512b2d642
  • SSDEEP 98304:MZiPUSI1yOJk+L7xJ6zMA8q33nRsKRABzueL:zUSI1yOiSmz8uRI
  • TLSH
    T1DC567B51FE9784F6E80B2631589B626F23385D050F2ACBD7E6447B3AECBB2C50876345
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutiondestiny_stealerstormkittypersistenceprivilege_escalationspywarestealer

  • Family: Destiny Stealer

    DestinyStealer is a stealer written in C#.

    stealerdestiny_stealer

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2