General

  • Target

    Mail_AccesCheckerV3.zip

  • Size

    9MB

  • Sample

    221001-rhphlsgba7

  • MD5

    3f10164b84ce3c7378f78a2e76c1618a

  • SHA1

    1a4eb074a80652d124c46b841f0b28f5e604d1fc

  • SHA256

    fc1fc30ebcee7cac04595ac90e26d8705b6a4b75df793cb63a21b47f3b46164b

  • SHA512

    4a37ef981839e9e6ecf2039d50c8226bcc05a2e85ac9c9f2a2b06179f57bc751e4283e1712b358a9ce587b0c43bfecf848488030047ee7958a2c2c58ff7b591c

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot5528293567:AAEvVqFZRYkeHFch3_kTGdMV2u4Swi0-pT8/sendMessage?chat_id=1787677484

Attributes
delay
3
install
false
install_folder
%AppData%
aes.plain

Targets

    • Target

      Mail_AccesCheckerV3.exe

    • Size

      9MB

    • MD5

      b569d5ade4cf07fb5bcf5ddf68ebbf07

    • SHA1

      4725efac826842a09c43333b3b41ca5e1857b1bd

    • SHA256

      1077895d8661aa99f9f051adbde40bf3d96c728631ab80855cd7579a6c967080

    • SHA512

      1f048fd0771c6e9abac3299f43191be76b5eac7e7a94a2ac825b646b135106ce50071f1ff510bca698595062d8d40829278fd82ac0ad2c72fd8a676dae7fbd5f

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Async RAT payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation