Extracted

• • Target

    Nitro Geg.exe

  • Size

    170KB

  • MD5

    c1d9bfff281d25c10356fa8a4d4423b8

  • SHA1

    9a87dd9f13b79eef27b789983ada8ed923864406

  • SHA256

    2ef0e305a16c3e7146c32b8d82ce0ffa06c3f3801bf6ae860fa6e9086d820c13

  • SHA512

    64fe9cd879b25716a72f4a12e5ae36a150d508f17799a58a1c9c4077c9aeb212777372e1f5fdd1ff77c8894d610049754c009ee6592f4c85600b5d88c04c03f1

  • SSDEEP

    3072:++STW8djpN6izj8mZwhp0II4IDqIPu/i9bvO2calhiZdaM6+Wp7:j8XN6W8mmhxFIXPSi9bmYriZd

  Score

  10^/10

  asyncratstormkittydefaultratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2