Extracted

• • Target

    09ee64f8bb9aebb6a09da283e34c528a.exe

  • Size

    232KB

  • MD5

    09ee64f8bb9aebb6a09da283e34c528a

  • SHA1

    3b55fff91903daf89131c1ee51653c7cf4027d18

  • SHA256

    e03f6c4f04ef25238b6d7c8a447555402caa7d1ddb1803bbb6cbcb889cab1135

  • SHA512

    e12a387b578dc1b1307e9bc7fb43e9da5b4a10106958fb329e171f8851767911814e74e2c7468460d00a9adf1691430be28439a087e12383a16a27b8e490aebf

  • SSDEEP

    6144:bDubaBBOBIIj6HLLYLCYJqvc1DMaJ+2+AHbEr1peYGrNNaR0NUg:ubaj9Gk1pLZi

  Score

  10^/10

  asyncratstormkittydefaultratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2