MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


StormKitty


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4
SHA3-384 hash: 208ac88af4ccb20473bd99f1ab42b54b06cba8ec9fcd1cab01dd6a8d193607d55b1c6c721f12e928ae7ff6103386bb24
SHA1 hash: 58c485a9754484b7151e98d91c72255f5f67bd74
MD5 hash: 7374ae2bce6ed9da84444231b1463ff5
humanhash: sixteen-utah-fanta-ink
File name:ekstre.pdf.exe
Download: download sample
Signature StormKitty
Create hunting rule
File size:584'192 bytes
First seen:2022-07-20 09:58:51 UTC
Last seen:2022-07-20 10:50:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 6144:X/upsBj95jPm31hjRyghK6XypXxhLd01KZVpypPf0psp/UgmLGFFDyRcUF7VaFOg:9X831hRK6GXxX0QbsigXab7VUeCFhf
Threatray 380 similar samples on MalwareBazaar
TLSH T1CEC4E000367C9FA2D5BD97FD6464608103F62A5F6A2DE38D4ED2B0EF2A76F510950E0B
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b271c0cccccc61b2 (16 x AgentTesla, 8 x Loki, 8 x SnakeKeylogger)
Reporter GovCERT_CH
Tags:exe StormKitty

Intelligence

File Origin
# of uploads :
2
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/292878/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.3810.5328.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d7d1f58fbcdde3605fbb76/reports/4bd54eff-df85-46c5-8a33-e4743b1e9086/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1037354
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-07-20 09:59:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
21 of 26 (80.77%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5xdul3n4sdp3riyoctuqjgmyxq6ha7vnw6wd56dyl4gib37da3ca._file
Verdict:
malicious
Similar samples:
0fe48a175b79a47314cc8ef8d5768e0a911e08da6b855faba6b41ec82bdebc4b
StormKitty
3c000108374c842e22e4bf480441d013e260c170c6d87defb15c322a4d136adb
StormKitty
74f8c18d247ab45ceb774418eb3604377501c92c6db387d070ba0511d9e82f04
StormKitty
8faa7dad16faf6ac824c0e73f7184c0498484caab2a58daa974349ecc17e0409
StormKitty
9a2cb78785196ff5a09b428bcf2325d0d3f2455d3607e86edac32273b9a66705
StormKitty
abd0a804168a65ceb8827d34d11b58601eb5d947637ee9fdd2dffa3a4afc9961
StormKitty
bc38b033642b64f5aabea83069639bed9dd1197c0ecab8bcdd225010adc45fe3
StormKitty
bcc6ba14b357c5f88e7e495d16411be6d488918c743214018db2c8e45961fd94
StormKitty
be855c00e706c2548c5ef6fc3da5a1b3c70633b097228f9b734eac6d69499ce3
StormKitty
f9f068d3c13e5a04ea12013ee0b7c6984d7ea23b74d5147e144b939d52524b22
StormKitty
+ 370 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:blustealer family:stormkitty collection spyware stealer
Link:
https://tria.ge/reports/220720-lz275seefr/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Checks computer location settings
BluStealer
StormKitty
StormKitty payload
Unpacked files
SH256 hash:
1651a3b2dcee38896adb509cfa9974724162a929bac4c08371d24365416e11c6
MD5 hash:
905198b7aa094c3c60950d1e9f1d6b04
SHA1 hash:
e151ed5e8a5035121c7d54876ae0f73b1840b302
Link:
https://www.unpac.me/results/710f8119-6281-4961-911a-3a5c1dc9edcd/
SH256 hash:
d12f31e32b81d27ba17c3d4bd978910fc06b16f17f6d7cd5e82f06e38c12f295
MD5 hash:
97afd62b9437598edd6ae62ec87520d3
SHA1 hash:
52a4a21663529fc836219730a3907c605dec1cd1
Detections:
win_agent_tesla_g2
Create hunting rule
Link:
https://www.unpac.me/results/710f8119-6281-4961-911a-3a5c1dc9edcd/
Parent samples :
edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4
67b1c9f9637d8c16e2966babd6b7a06c2396cbc918b31c0649adf61b7a2a7778
b287de3756df371e1046322a567e8d8394a85915a80838c1832388a88c9dd9cd
755de0017346d362f97a588336b88adc8d078bb699a2395c2957daa26207c16b
19b0d58c3611ccc99f681997248a835ac4a49572a50278f4f7c732237183db6a
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
Link:
https://www.unpac.me/results/710f8119-6281-4961-911a-3a5c1dc9edcd/
SH256 hash:
8e7c7ce38bc0fdfe5a87fd709a59cea1c97b5c87effe53212dfb2e08d7385667
MD5 hash:
1e67dbcf4bab3b301e08d1328a55a04f
SHA1 hash:
8895cd6c7374e9ef79c40046b0bd9ff57e58d69f
Link:
https://www.unpac.me/results/710f8119-6281-4961-911a-3a5c1dc9edcd/
SH256 hash:
ca4e3745f87ae419e10fa9dd15e9814f66a7dca601ae70bd3ae3b0b0781e9491
MD5 hash:
6491ab64072f34a6124f4cdf1d9bdd43
SHA1 hash:
78008e0c188d1732ebb5bbfe6d15892ebe32b1f7
Link:
https://www.unpac.me/results/710f8119-6281-4961-911a-3a5c1dc9edcd/
SH256 hash:
53890427c8da62fa47ffb0bc04d0b3c96fdc5cd24cca02b358695e18fbda2ac0
MD5 hash:
8a0197e3523fcc0684f7ef92fb78ac9e
SHA1 hash:
4d5d50dc3e37773cbb9b0bf50a36471c3fd8e1f3
Link:
https://www.unpac.me/results/710f8119-6281-4961-911a-3a5c1dc9edcd/
SH256 hash:
edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4
MD5 hash:
7374ae2bce6ed9da84444231b1463ff5
SHA1 hash:
58c485a9754484b7151e98d91c72255f5f67bd74
Link:
https://www.unpac.me/results/710f8119-6281-4961-911a-3a5c1dc9edcd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/edc745edbc90/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

StormKitty

Executable exe edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/292878/

Comments