General
-
Target
kdmapper_stealer.exe
-
Size
175KB
-
Sample
240511-pgnhtaae72
-
MD5
a5e04e2996186311ce58c25fef43a779
-
SHA1
3a3f2116116850fa52b82a12d6c052d0bd74e60b
-
SHA256
a302f5eb849f5873826ff3f2034075450430d65051809ca6489db3da754e3bea
-
SHA512
552d05803b2e41144cb9ba7852d6dea066dc03dbfec46688dd0c3e92b237b795a3bec03d4b737dd36b284f8a36ca61aaf466ecc7a56898d806480012f53834a7
-
SSDEEP
3072:Xe8F4hUIcmRtpGh0I/bv9Lv0cU+lL/dMlZZUZ0b2gTpXwARE+WpCz:34h3pRtEh0I90c5MlYZ0b2q9
Behavioral task
behavioral1
Sample
kdmapper_stealer.exe
Resource
win7-20240508-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
kdmapper_stealer.exe
-
Size
175KB
-
MD5
a5e04e2996186311ce58c25fef43a779
-
SHA1
3a3f2116116850fa52b82a12d6c052d0bd74e60b
-
SHA256
a302f5eb849f5873826ff3f2034075450430d65051809ca6489db3da754e3bea
-
SHA512
552d05803b2e41144cb9ba7852d6dea066dc03dbfec46688dd0c3e92b237b795a3bec03d4b737dd36b284f8a36ca61aaf466ecc7a56898d806480012f53834a7
-
SSDEEP
3072:Xe8F4hUIcmRtpGh0I/bv9Lv0cU+lL/dMlZZUZ0b2gTpXwARE+WpCz:34h3pRtEh0I90c5MlYZ0b2q9
-
StormKitty payload
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-