MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06a16b27c0fb73721a8e914688491abab539ea56fbe8df580fa91b22a0c8afec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


StormKitty


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06a16b27c0fb73721a8e914688491abab539ea56fbe8df580fa91b22a0c8afec
SHA3-384 hash: efc42b240dfe786c361f42f1722e630410c3021ce203fb9701c78cc5a81a0082a314f1ec1b7071beb945ca1b0f7f13f8
SHA1 hash: 81401ab6f1e291774d5465750eaedac986d4dc3b
MD5 hash: 74c571340a29f8b79e012e9d835ac426
humanhash: speaker-carpet-one-purple
File name:SecuriteInfo.com.Win32.PWSX-gen.3137
Download: download sample
Signature StormKitty
Create hunting rule
File size:170'368 bytes
First seen:2022-09-22 13:00:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:ep8xfXO3mVO6ipX6PN6BrjZy7EZRgA3NAR8MrDgeLdj8bKrOHm:k8xfQmVtipX6VWDHCRhXFdoO6G
Threatray 81 similar samples on MalwareBazaar
TLSH T1ECF39C887640B28FC827C937CAD94C50ABA87967572BC203B45773AD990D7DBCF150EA
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter SecuriteInfoCom
Tags:exe StormKitty

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
quasar
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.3137
Verdict:
Malicious activity
Analysis date:
2022-09-22 13:01:49 UTC
Tags:
evasion stealer quasar
Link:
https://app.any.run/tasks/899afeaf-9335-4369-87fc-7ba19c53cc75

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/312348/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.3137.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/632c5d1739767769653c5dee/reports/824fde77-f041-4634-9933-93d83c3ae908/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BluStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80715af3-2b0e-4e73-9148-23d58b68de3b
Result
Threat name:
BluStealer, StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1075285
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected BluStealer
Yara detected Generic Downloader
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06a16b27c0fb73721a8e914688491abab539ea56fbe8df580fa91b22a0c8afec/
Threat name:
ByteCode-MSIL.Infostealer.Azorult
Create hunting rule
Status:
Malicious
First seen:
2022-09-22 10:03:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
8 of 40 (20.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2qwwj6a7nzxeguosfdiqsi2xk2tt2sw7pun6wapvensfigiv7wa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2158793474c9422d0e1021d2dd73423908cf2e54b40d9801afe8a0611b89cbb7
StormKitty
57eb07bbd93ef06938180786e64bf2f42bcb3be8525c6217a8713096a078ada5
StormKitty
a4e136e1ed1c634f0e0d8a11d7fdfa2fd1a316d90c1f2f18d92af62cb1a2f924
StormKitty
b3b1eef8987078bc78e6cb0b45adf5cb7959fe3eedd316092d5881114fb25762
StormKitty
c5aaaf40148a7d8bd30681af759e7e922c491404610c1691d3ce7d1c1b849bcd
StormKitty
db9b829443caa52821b672731426400ed85709bb7aec5093c845e144b962faeb
StormKitty
e9e93ee1b8ac56b5e18d639d1d1f5863684b18fdf5b9c5dcc7f542794c8d530b
StormKitty
+ 71 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:blustealer family:stormkitty collection spyware stealer
Link:
https://tria.ge/reports/220922-p872jabef3/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
BluStealer
StormKitty
StormKitty payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5627356603:AAG-Mx0TbSHRRW6IwndrpX3VLZdhd6C-Zac/sendMessage?chat_id=5472437377
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bb16a570-609d-4a6d-9f7c-b7abe0690a9e
Unpacked files
SH256 hash:
316cdc3918f3ccb2c9b0bb19e73b4eae2d4633ce31d1f097bbd87e66065547ad
MD5 hash:
16a70ead6c19d9e557b0cae29ef360bb
SHA1 hash:
e21ed45f72ed6db9e384dd125df46fd7d2e60157
Link:
https://www.unpac.me/results/d471a253-f48a-41f6-9f7a-95502a7ed9bd/
SH256 hash:
817dbea9010a3ed4a58b0e538e27eaa1491144c446de2f6d290e07b97b8800fa
MD5 hash:
2324d4bfbe8b6f8e1950ee94c6253706
SHA1 hash:
88d8d1f946613c877261d281e0363eb5665dc544
Link:
https://www.unpac.me/results/d471a253-f48a-41f6-9f7a-95502a7ed9bd/
SH256 hash:
5fcd4e3a9fcbd19f89d73919311d52abdcf95994123942ac533e60a9f198e1d6
MD5 hash:
21080c64225c8f730626c293703cc378
SHA1 hash:
574eb72eefc0264c2149daae53fd26c5494b6071
Link:
https://www.unpac.me/results/d471a253-f48a-41f6-9f7a-95502a7ed9bd/
SH256 hash:
06a16b27c0fb73721a8e914688491abab539ea56fbe8df580fa91b22a0c8afec
MD5 hash:
74c571340a29f8b79e012e9d835ac426
SHA1 hash:
81401ab6f1e291774d5465750eaedac986d4dc3b
Link:
https://www.unpac.me/results/d471a253-f48a-41f6-9f7a-95502a7ed9bd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/06a16b27c0fb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/06a16b27c0fb73721a8e914688491abab539ea56fbe8df580fa91b22a0c8afec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/312348/

Comments