General
- Target QuotePDF.vbs
- Size 444KB
- Sample220127-r757naeebl
- SHA256 8dba6450d3ff2ac99d519d8f75affdcbb25bf5743e265246e0bfedd60a325a28
Score
10/10
Malware Config
Targets
-
- Target QuotePDF.vbs
- Size 444KB
- SHA256 8dba6450d3ff2ac99d519d8f75affdcbb25bf5743e265246e0bfedd60a325a28
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
suricata: ET MALWARE StormKitty Data Exfil via Telegram
suricata: ET MALWARE StormKitty Data Exfil via Telegram
-
Async RAT payload
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.