Extracted

• • Target
    78f7efed48c531657b84cd66911c7eef.exe
  • Size 605KB
  • SHA256 40ba4a68575cda8b4da56ef2efae3f3c217bf7b78d68c29086e86d324d3ebffa
  • MD5 78f7efed48c531657b84cd66911c7eef
  • SHA1 eedcf0f081c78adfcefe3e9208bc83b252f1b4aa
  • SHA512 519a27a1d28e855d2b8c128f8723200ff7f790069f8087a2c6470e8437b12192a444a79ff4024cf278215db718391e770b783dc167ea321efbfc76e2411c26df
  • SSDEEP 12288:JvqsfIozrJqppjn1rmq12WaD+1Fri1xbcR:h9vrMjn1r5aCjg9cR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratquasarstormkittydefaultratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2