{
	"id": "326a5fd1-802a-413d-bb11-b31890b588c9",
	"created_at": "2026-04-06T00:15:27.197213Z",
	"updated_at": "2026-04-10T03:36:48.434468Z",
	"deleted_at": null,
	"sha1_hash": "01b9193953d619267354d5be30e7345d391d674c",
	"title": "GitHub - LimerBoy/StormKitty: Open source stealer written on C#, all logs will be sent to Telegram bot.",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1241770,
	"plain_text": "GitHub - LimerBoy/StormKitty: Open source stealer written on\r\nC#, all logs will be sent to Telegram bot.\r\nBy LimerBoy\r\nArchived: 2026-04-05 20:33:54 UTC\r\nStealer + Clipper + Keylogger\r\nStealer written on C#, logs will be sent to Telegram bot.\r\n Disclaimer\r\nI, the creator, am not responsible for any actions, and or damages, caused by this software. You bear the full\r\nresponsibility of your actions and acknowledge that this software was created for educational purposes only. This\r\nsoftware's main purpose is NOT to be used maliciously, or on any system that you do not own, or have the right to\r\nuse. By using this software, you automatically agree to the above.\r\n Data extraction:\r\nAntiAnalysis (VirtualBox, SandBox, Debugger, VirusTotal, Any.Run)\r\nGet system info (Version, CPU, GPU, RAM, IPs, BSSID, Location, Screen metrics, Installed apps)\r\nChromium based browsers (passwords, credit cards, cookies, history, autofill, bookmarks)\r\nFirefox based browsers (db files, cookies, history, bookmarks)\r\nInternet explorer/Edge (passwords)\r\nSaved wifi networks \u0026 scan networks around device (SSID, BSSID)\r\nFile grabber (Documents, Images, Source codes, Databases, USB)\r\nDetect banking \u0026 cryptocurrency services in browsers\r\nSteam, Uplay, Battle.Net, Minecraft session\r\nInstall keylogger \u0026 clipper\r\nhttps://web.archive.org/web/20230403114012/https://github.com/LimerBoy/StormKitty\r\nPage 1 of 4\n\nDesktop \u0026 Webcam screenshot\r\nProtonVPN, OpenVPN, NordVPN\r\nCryptocurrency Wallets\r\nDirectories structure\r\nTelegram sessions\r\nOutlook accounts\r\nPidgin accounts\r\nSkype session\r\nDiscord tokens\r\nFilezilla hosts\r\nProcess list\r\nProduct key\r\nAutorun module\r\n Features:\r\nThese functions will become available in the builder only if you have autorun enabled.\r\n Builder:\r\nGo to the @BotFather bot and create your own bot. You need to save token and bot name.\r\nNow you need to get your chat id. To do this, go to the next bot @chatid_echo_bot and save the id.\r\nInsert this data in builder console\r\n Download compiled builder and source code\r\nhttps://web.archive.org/web/20230403114012/https://github.com/LimerBoy/StormKitty\r\nPage 2 of 4\n\nTelegram notification:\r\nhttps://web.archive.org/web/20230403114012/https://github.com/LimerBoy/StormKitty\r\nPage 3 of 4\n\nDonate:\r\nBTC: 1GvEsEEdD8kfbSia6QR3Hk1G4fzy2mwZE4\r\nETH: 0x4f62ce9632efF28f175aAAdd58B14A0AC053A952\r\nXMR:\r\n487sRQv2gBXHVPc59Lkz5j7bgJ28Qy8nPW6hUvRyFWxM84cWzEnmVcWf6MWEQ59BwrP4viyoz6gfqhDPb1yiUx2SUViKVwd\r\n Thanks for the development help:\r\n@0xPh0enix\r\nSource: https://web.archive.org/web/20230403114012/https://github.com/LimerBoy/StormKitty\r\nhttps://web.archive.org/web/20230403114012/https://github.com/LimerBoy/StormKitty\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://web.archive.org/web/20230403114012/https://github.com/LimerBoy/StormKitty"
	],
	"report_names": [
		"StormKitty"
	],
	"threat_actors": [
		{
			"id": "9f101d9c-05ea-48b9-b6f1-168cd6d06d12",
			"created_at": "2023-01-06T13:46:39.396409Z",
			"updated_at": "2026-04-10T02:00:03.312816Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"CHROMIUM",
				"ControlX",
				"TAG-22",
				"BRONZE UNIVERSITY",
				"AQUATIC PANDA",
				"RedHotel",
				"Charcoal Typhoon",
				"Red Scylla",
				"Red Dev 10",
				"BountyGlad"
			],
			"source_name": "MISPGALAXY:Earth Lusca",
			"tools": [
				"RouterGod",
				"SprySOCKS",
				"ShadowPad",
				"POISONPLUG",
				"Barlaiy",
				"Spyder",
				"FunnySwitch"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "18a7b52d-a1cd-43a3-8982-7324e3e676b7",
			"created_at": "2025-08-07T02:03:24.688416Z",
			"updated_at": "2026-04-10T02:00:03.734754Z",
			"deleted_at": null,
			"main_name": "BRONZE UNIVERSITY",
			"aliases": [
				"Aquatic Panda",
				"Aquatic Panda ",
				"CHROMIUM",
				"CHROMIUM ",
				"Charcoal Typhoon",
				"Charcoal Typhoon ",
				"Earth Lusca",
				"Earth Lusca ",
				"FISHMONGER ",
				"Red Dev 10",
				"Red Dev 10 ",
				"Red Scylla",
				"Red Scylla ",
				"RedHotel",
				"RedHotel ",
				"Tag-22",
				"Tag-22 "
			],
			"source_name": "Secureworks:BRONZE UNIVERSITY",
			"tools": [
				"Cobalt Strike",
				"Fishmaster",
				"FunnySwitch",
				"Spyder",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "6abcc917-035c-4e9b-a53f-eaee636749c3",
			"created_at": "2022-10-25T16:07:23.565337Z",
			"updated_at": "2026-04-10T02:00:04.668393Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Bronze University",
				"Charcoal Typhoon",
				"Chromium",
				"G1006",
				"Red Dev 10",
				"Red Scylla"
			],
			"source_name": "ETDA:Earth Lusca",
			"tools": [
				"Agentemis",
				"AntSword",
				"BIOPASS",
				"BIOPASS RAT",
				"BadPotato",
				"Behinder",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"Doraemon",
				"FRP",
				"Fast Reverse Proxy",
				"FunnySwitch",
				"HUC Port Banner Scanner",
				"KTLVdoor",
				"Mimikatz",
				"NBTscan",
				"POISONPLUG.SHADOW",
				"PipeMon",
				"RbDoor",
				"RibDoor",
				"RouterGod",
				"SAMRID",
				"ShadowPad Winnti",
				"SprySOCKS",
				"WinRAR",
				"Winnti",
				"XShellGhost",
				"cobeacon",
				"fscan",
				"lcx",
				"nbtscan"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d53593c3-2819-4af3-bf16-0c39edc64920",
			"created_at": "2022-10-27T08:27:13.212301Z",
			"updated_at": "2026-04-10T02:00:05.272802Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Earth Lusca",
				"TAG-22",
				"Charcoal Typhoon",
				"CHROMIUM",
				"ControlX"
			],
			"source_name": "MITRE:Earth Lusca",
			"tools": [
				"Mimikatz",
				"PowerSploit",
				"Tasklist",
				"certutil",
				"Cobalt Strike",
				"Winnti for Linux",
				"Nltest",
				"NBTscan",
				"ShadowPad"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434527,
	"ts_updated_at": 1775792208,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/01b9193953d619267354d5be30e7345d391d674c.pdf",
		"text": "https://archive.orkl.eu/01b9193953d619267354d5be30e7345d391d674c.txt",
		"img": "https://archive.orkl.eu/01b9193953d619267354d5be30e7345d391d674c.jpg"
	}
}