Extracted

• • Target

    Swift-PaymentInvoice20220331_pdf.exe

  • Size

    520KB

  • MD5

    72a9bcce9a210198f0d6a679b5bca7e4

  • SHA1

    d19326cef0a76c63343fb2a762331639ed6617c2

  • SHA256

    407f8e8ab8d4141df81d49cbb94e54ec89c80cd76ca0fa23b1bb2aa0ba74b0dc

  • SHA512

    ec190a3a1a887f8c4cd4863c671c5da20cc24ce6cb3ed14320a07e8e0318da7833bf882843175ea6cfe29a333839adca6f2bf4c606cba2ba0a7a012bb27824c6

  Score

  10^/10

  asyncratstormkittydefaultpersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty Payload

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2