Extracted

• • Target
    ILIKEMEN.exe
  • Size 74KB
  • SHA256 183c4a07c3859758dc971abf3351f0811698fcee4f846822d807fde8bd70021e
  • MD5 794f06f69365a10f17c4ecae5d782749
  • SHA1 179ab7369cf041ecddda5fc696b859db139d79df
  • SHA512 71bc81b17db3084000be4f34e25070120b497dd778136b5234026411b3ff4ca156e9ab89881f1320fb9f27991de842098ac3bbaeb2c4531886f621e0c07b18f4
  • SSDEEP 1536:eUiccx0dxCKg6PMVZ5S5KmiLHIy31bu/n16UOTQzcaLVclN:eUzcx0f9g6PMVZAAv31buxkQLBY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratdefaultdiscoveryratstormkittycollectionpersistencespywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2