Extracted

• • Target

    JC_tmp

  • Size

    175KB

  • MD5

    9f322fea404a9934e6c807108ebb2147

  • SHA1

    668174980eb20c9ce530b51e059714bc55a80d25

  • SHA256

    a3e5674bf7c3e285fb88bb0bfc284f3e74ece2706f46168c6da289e6267b96d7

  • SHA512

    2a5c3e87b7199f8b48cc0e8528e5d54052b7d8c596465666b13c4d348413931edf6985bbf3a72dcabdbb88363b4c073958081e534a79fb430ae2c3ddb4dbeb8d

  • SSDEEP

    3072:se8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gTewAqE+Wpor:FXtb5KcXr7XmfgqtjhAxZ0b2H

  Score

  10^/10

  asyncratstormkittydefaultratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2