MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ccc519f21b367c60802aab3acd365e95ca3fabaa744918b4e564dc234723115. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


StormKitty


Vendor detections: 10


Intelligence 10 IOCs YARA 13 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ccc519f21b367c60802aab3acd365e95ca3fabaa744918b4e564dc234723115
SHA3-384 hash: b93154ef4ddae1267b30ab30600b7372c04c60b4ca35aa7a61893dcf5e3c80be50a391f1af71c184e70372379a7df7a0
SHA1 hash: dcfdd85d9ef0d41855d3c28a56079c667bb5ca95
MD5 hash: 042dfde8e4f2ddf848c3fb4255671cb4
humanhash: high-timing-fish-william
File name:042dfde8e4f2ddf848c3fb4255671cb4
Download: download sample
Signature StormKitty
Create hunting rule
File size:130'560 bytes
First seen:2022-08-23 11:42:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:0n9vsCmcONKUX2mhS2ZRT+bEEF3UbpA3gCK:06GYimhS2D+bEEmC
TLSH T12CD3FA5877D88A01F1BD2AB59CF23120B771A4137A22D60E1DDD2AAD0DA3B84D514FBF
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter zbetcheckin
Tags:exe StormKitty

Intelligence

File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
042dfde8e4f2ddf848c3fb4255671cb4
Verdict:
No threats detected
Analysis date:
2022-08-23 11:50:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2ece896c-44c8-4603-a170-ccd213defe4a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
StormKitty
Create hunting rule
Link:
https://www.capesandbox.com/analysis/300496/
Detection(s):
SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

Win.Packed.AsyncRAT-9938103-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealerium Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/15e37be6-8595-472c-88f4-8bd6e504ee07
Result
Threat name:
StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1056444
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Yara detected Telegram Recon
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 688964 Sample: rDau6IJ5Ib Startdate: 23/08/2022 Architecture: WINDOWS Score: 100 26 dns.google 2->26 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus / Scanner detection for submitted sample 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 6 other signatures 2->46 8 rDau6IJ5Ib.exe 12 2->8         started        signatures3 process4 process5 10 chrome.exe 14 323 8->10         started        13 chrome.exe 8 8->13         started        dnsIp6 28 192.168.2.1 unknown unknown 10->28 30 192.168.2.4 unknown unknown 10->30 32 239.255.255.250 unknown Reserved 10->32 15 chrome.exe 35 10->15         started        18 chrome.exe 10->18         started        20 chrome.exe 1 10->20         started        24 4 other processes 10->24 22 chrome.exe 13->22         started        process7 dnsIp8 34 dual-a-0001.dc-msedge.net 131.253.33.200, 443, 49747, 49750 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 15->34 36 20.190.159.19, 443, 49867, 49894 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 15->36 38 13 other IPs or domains 15->38
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ccc519f21b367c60802aab3acd365e95ca3fabaa744918b4e564dc234723115/
Threat name:
ByteCode-MSIL.Infostealer.StormKitty
Create hunting rule
Status:
Malicious
First seen:
2022-08-23 11:43:09 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
2
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ntgfdhzbwnt4mcacvkz2zu3f5fokh6v2u5cjdc2okzg4endsgekq._file
Verdict:
malicious
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:stormkitty persistence
Link:
https://tria.ge/reports/220823-nvkhmseban/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Adds Run key to start application
Unpacked files
SH256 hash:
6ccc519f21b367c60802aab3acd365e95ca3fabaa744918b4e564dc234723115
MD5 hash:
042dfde8e4f2ddf848c3fb4255671cb4
SHA1 hash:
dcfdd85d9ef0d41855d3c28a56079c667bb5ca95
Link:
https://www.unpac.me/results/2704dc0b-0e46-466f-8d55-2017a8c08902/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/6ccc519f21b367c60802aab3acd365e95ca3fabaa744918b4e564dc234723115

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing credit card regular expressions
Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:INDICATOR_SUSPICIOUS_EXE_Discord_Regex
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Discord tokens regular expressions
Rule name:INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
Create hunting rule
Author:ditekSHen
Description:Detects executables (downlaoders) containing URLs to raw contents of a paste
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_VPN
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many VPN software clients. Observed in infosteslers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
Create hunting rule
Author:ditekSHen
Description:Detects executables with interest in wireless interface using netsh
Rule name:MALWARE_Win_StormKitty
Create hunting rule
Author:ditekSHen
Description:Detects StormKitty infostealer
Rule name:SUSP_Discord_Attachments_URL
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

StormKitty

Executable exe 6ccc519f21b367c60802aab3acd365e95ca3fabaa744918b4e564dc234723115

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2275969/
Cape
Cape
https://www.capesandbox.com/analysis/300496/

Comments


Avatar
zbet commented on 2022-08-23 11:42:28 UTC

url : hxxp://37.139.129.142/htdocs/DwRTZrdGCKiWaSL.exe