stormkitty | LOG TO ULP[.]exe

General

Target
LOG TO ULP.exe
Size 27.4MB
Sample261006-2cparsysbs
SHA256 689f31dd7ded0ab5ab7197f89106d346a52b5e156929fa344b51b70a316e7005
MD5 3f7a89323455842ab32e31684e2a78c9
SHA1 c201e8e8be72d8b4aed2662153141b0e29dea147
SHA512 96bbf50a97c3af11adf9ed41c7699870279c7c7fa206b0e4820ddd4254ca54c2560b1d6d6365f7694dcf7bded02a2ff4ca5ef77a2ad891de6841b1995327f518
SSDEEP 786432:2i5STfW8n0gCdLLsKMMo5ovsVuxFQJZPCD3r4:2iAWvgCKoeqKE3r
TLSH
T128573310325591B6F937A378E2D9D824CB39B04A5B25C2DA77E850200ED37F9BE3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer stormkitty

Malware Config

Signatures

Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
sample	family_stormkitty

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LOG TO ULP.exe

File Explorer

LOG TO ULP.exe

.exe 27.4MB
LOG TO ULP.pyc

64KB

LOG TO ULP.exe

IMPHASH 9222d372923baed7aa9dfa28449a94ea
SHA256 689f31dd7ded0ab5ab7197f89106d346a52b5e156929fa344b51b70a316e7005
MD5 3f7a89323455842ab32e31684e2a78c9
SHA1 c201e8e8be72d8b4aed2662153141b0e29dea147
SHA512 96bbf50a97c3af11adf9ed41c7699870279c7c7fa206b0e4820ddd4254ca54c2560b1d6d6365f7694dcf7bded02a2ff4ca5ef77a2ad891de6841b1995327f518
SSDEEP 786432:2i5STfW8n0gCdLLsKMMo5ovsVuxFQJZPCD3r4:2iAWvgCKoeqKE3r
TLSH
T128573310325591B6F937A378E2D9D824CB39B04A5B25C2DA77E850200ED37F9BE3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

StormKitty payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb

kernel32

CreateFileA FindResourceA FreeLibrary LoadResource WriteFile SizeofResource GetProcAddress LoadLibraryA LockResource EnumResourceNamesA CloseHandle FreeResource GetWindowsDirectoryA OutputDebugStringA GetTempPathA GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW Sleep HeapSize GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW MultiByteToWideChar GetStringTypeW

shell32

ShellExecuteA SHGetSpecialFolderPathA

Sharing