General
-
Target
Disney [CHECKER] V3.2.exe
-
Size
16.4MB
-
Sample
230223-twy1baad3t
-
MD5
54fc962e8963129ed9ee02f93c61ca0c
-
SHA1
b08648d5517b81f6cbc3f5769375d0df70242c65
-
SHA256
2eee592b19e01789f384e99ce780785722a66f6abd6a01db3a135f7840892275
-
SHA512
d84dd713d757cb0e7948706536ed84ff2fd0e354c61deca7ef0f17c87940683d40a3eee616d1f93c8d5d1c73f22642d547fbfdb5b47517e6cadfa374a4272bdc
-
SSDEEP
393216:ou7L/1edQ2l6+9Joaw2N+mzW8+OQwGJLaX4FcYqP:oCLdedQm9Jq2NZW8+hVc
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6196076192:AAF99zylbr46S6zR2M6Fbv7gE0eAuYfzRmg/sendMessage?chat_id=927024838
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
Disney [CHECKER] V3.2.exe
-
Size
16.4MB
-
MD5
54fc962e8963129ed9ee02f93c61ca0c
-
SHA1
b08648d5517b81f6cbc3f5769375d0df70242c65
-
SHA256
2eee592b19e01789f384e99ce780785722a66f6abd6a01db3a135f7840892275
-
SHA512
d84dd713d757cb0e7948706536ed84ff2fd0e354c61deca7ef0f17c87940683d40a3eee616d1f93c8d5d1c73f22642d547fbfdb5b47517e6cadfa374a4272bdc
-
SSDEEP
393216:ou7L/1edQ2l6+9Joaw2N+mzW8+OQwGJLaX4FcYqP:oCLdedQm9Jq2NZW8+hVc
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-