Extracted

• • Target

    1006.exe

  • Size

    225KB

  • MD5

    883784a3500e2389e6e1816696dba87b

  • SHA1

    f4364ff100c016d5cf78a3a4e3bedb287555f2ce

  • SHA256

    0373eb783358fbf3b810fe1156efffd5847913c62db0e6c690e802300a5640ab

  • SHA512

    f5d4d508dfeee159d339b9833d8128a6486b866639cd5dcba381b873188c3a6e643961477e723e38d100c3a5b47b0c83499e18504b1a6e5f5e68a73bf01e73f3

  • SSDEEP

    3072:/+STW8djpN6izj8mZwgWDZ5IRN9MBQVahUbBEgDzazaLEV55NlmwXcFOC+UX6+WO:08XN6W8mmgqQMhUbOKEV55NlXkOI

  Score

  10^/10

  asyncratstormkittydefaultratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory

  behavioral1behavioral2