Overview

overview

10

Static

static

10

0x00060000...71.exe

windows7-x64

10

0x00060000...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x00060000000231c7-271.dat

  • Size

    232KB

  • Sample

    230324-r83g6ahb91

  • MD5

    b322016149eb06ae727524dc17c2f631

  • SHA1

    890c2ebfd66f9bc72fc5e68ec667f25c74fae633

  • SHA256

    a3ce8f441abbbea97d7f9bd4fe968cc05612e4810c91c5036e84ad53f1a3738d

  • SHA512

    eb1da37182dfd279e39bf406310469b542d90a55b18599dd4e53f51ee76e0e37de88cde8d4cdfb3b9759e83f385fb38338f2ba120f313bf306c9d18df47a5225

  • SSDEEP

    6144:kDubaBBOBIIj6HLLYLCYJqvc1Dqqk0AonP1HboHmw0bzlELV8SMad:1baZ/2UHa/lEpTMa

Score
10/10
asyncratstormkittydefaultratspywarestealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      0x00060000000231c7-271.dat

    • Size

      232KB

    • MD5

      b322016149eb06ae727524dc17c2f631

    • SHA1

      890c2ebfd66f9bc72fc5e68ec667f25c74fae633

    • SHA256

      a3ce8f441abbbea97d7f9bd4fe968cc05612e4810c91c5036e84ad53f1a3738d

    • SHA512

      eb1da37182dfd279e39bf406310469b542d90a55b18599dd4e53f51ee76e0e37de88cde8d4cdfb3b9759e83f385fb38338f2ba120f313bf306c9d18df47a5225

    • SSDEEP

      6144:kDubaBBOBIIj6HLLYLCYJqvc1Dqqk0AonP1HboHmw0bzlELV8SMad:1baZ/2UHa/lEpTMa

    Score
    10/10
    asyncratstormkittydefaultratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks