MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ea4808f0889b9dc62f93e537ddbec6f3e35dd7b5be2a3e75c4ef1a5cd5d9256. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


StormKitty


Vendor detections: 10


Intelligence 10 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ea4808f0889b9dc62f93e537ddbec6f3e35dd7b5be2a3e75c4ef1a5cd5d9256
SHA3-384 hash: b54779935f123ecd2a34a5579875dd621c58e24665f5a8120b3c6a00e4495e03bdb9c1fe8f95bce1b4813b893bbe323c
SHA1 hash: 3e31f84b6555539365f3c42403fdc73d8532d7d7
MD5 hash: ac2b7f66f2c5fe32220626b45fb90626
humanhash: carolina-stairway-friend-batman
File name:SecuriteInfo.com.Trojan.PWS.StealerNET.74.4853.10232
Download: download sample
Signature StormKitty
Create hunting rule
File size:105'472 bytes
First seen:2021-06-03 22:02:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 3072:KvE6ITzqgWRu3PtaMbC5Wyn+KmVSj4Dm7:9xTZYoPtjbY
Threatray 2 similar samples on MalwareBazaar
TLSH B7A3095537E40524F2FE4BB4ACF100658A71B0177826D6AF1AEE1B6D0DB97E4C920FA3
Reporter SecuriteInfoCom
Tags:exe StormKitty

Intelligence

File Origin
# of uploads :
1
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.PWS.StealerNET.74.4853.10232
Verdict:
Suspicious activity
Analysis date:
2021-06-03 22:10:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0a6e20ee-fb6e-4a18-a3c8-98cce10a1bc1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
StormKitty
Create hunting rule
Link:
https://www.capesandbox.com/analysis/164509/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/797000
Signature
Contains functionality to capture screen (.Net source)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ea4808f0889b9dc62f93e537ddbec6f3e35dd7b5be2a3e75c4ef1a5cd5d9256/
Threat name:
ByteCode-MSIL.Infostealer.StormKitty
Create hunting rule
Status:
Malicious
First seen:
2021-06-03 10:52:58 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
40afa1e323be151d0d7a38c72f771b0b9e909f49ddade942d4260a5e29e5ec2f
StormKitty
5389a958986f6ceccaa9e44006852becbccabfb07f126d69e6b031227fb0b487
StormKitty
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:stormkitty
Link:
https://tria.ge/reports/210603-drxt981k7a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
6ea4808f0889b9dc62f93e537ddbec6f3e35dd7b5be2a3e75c4ef1a5cd5d9256
MD5 hash:
ac2b7f66f2c5fe32220626b45fb90626
SHA1 hash:
3e31f84b6555539365f3c42403fdc73d8532d7d7
Link:
https://www.unpac.me/results/8e69dedd-e4b9-494e-ba8c-e9194aab3f42/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6ea4808f0889b9dc62f93e537ddbec6f3e35dd7b5be2a3e75c4ef1a5cd5d9256

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cryptocoin_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_StormKitty
Create hunting rule
Author:ditekSHen
Description:Detects StormKitty infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Stealer_word_in_memory
Create hunting rule
Author:James_inthe_box
Description:The actual word stealer in memory
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

StormKitty

Executable exe 6ea4808f0889b9dc62f93e537ddbec6f3e35dd7b5be2a3e75c4ef1a5cd5d9256

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1320958/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/164509/

Comments