Extracted

• • Target

    d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a

  • Size

    1006KB

  • MD5

    9b37096274af2542b2e8e5460a32ad92

  • SHA1

    fd1bd3fe73844de5f69dfc4b42e9f40aa4395308

  • SHA256

    d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a

  • SHA512

    2297155b35eadd6d0fcad613d954558f116c9ff660ce7470f428123a99840747056e8648d51c31b86ccd900ace9075f4888e47dd9cac8dc228f40c21e49de994

  • SSDEEP

    24576:2TbBv5rUDKoU7LEoW9MZBGa6mXcqIAXiAZfzI6l:IBUUPEjKGLAXiAZz

  Score

  10^/10

  asyncratstormkittydefaultratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2