General
-
Target
46a245f3fb1b672c3edfa6ad7f542cc12afe31f57e23a988105191ac34024c0b
-
Size
1.2MB
-
Sample
230210-he326afa3s
-
MD5
dc181cd3fafcf924fa401b553e82e14f
-
SHA1
cff9bedf6b34f83b44415b8841f3b65e2f1a6bc2
-
SHA256
46a245f3fb1b672c3edfa6ad7f542cc12afe31f57e23a988105191ac34024c0b
-
SHA512
345fbe852903239fd4e8ae9ea96617210873e3afc71793e4265aa58358f85f5738c9f9c71c9fdcbcd0725df3f685b3d20757eac8741622915220f756ebe5d24e
-
SSDEEP
24576:nsiogwnhfyRTS0mh2MoM5oE8f42RiRSuFfe5U0BGSg5Fo9rMuFfe5U0dKn:nzZU4MzL242Y0uFXSQFYMuFr
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5274110003:AAHr0AxLpzec5oVOcuZRHUVbWfEZZxz4b1o/sendMessage?chat_id=695169423
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
46a245f3fb1b672c3edfa6ad7f542cc12afe31f57e23a988105191ac34024c0b
-
Size
1.2MB
-
MD5
dc181cd3fafcf924fa401b553e82e14f
-
SHA1
cff9bedf6b34f83b44415b8841f3b65e2f1a6bc2
-
SHA256
46a245f3fb1b672c3edfa6ad7f542cc12afe31f57e23a988105191ac34024c0b
-
SHA512
345fbe852903239fd4e8ae9ea96617210873e3afc71793e4265aa58358f85f5738c9f9c71c9fdcbcd0725df3f685b3d20757eac8741622915220f756ebe5d24e
-
SSDEEP
24576:nsiogwnhfyRTS0mh2MoM5oE8f42RiRSuFfe5U0BGSg5Fo9rMuFfe5U0dKn:nzZU4MzL242Y0uFXSQFYMuFr
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-