Extracted

• • Target

    Server.exe

  • Size

    175KB

  • MD5

    93f59dfbc510724cd813a4932c940288

  • SHA1

    b36c6fdedcde70cbbbc8ac1d2c525f6720a71695

  • SHA256

    e709b46999c2c10f2b7c29de74d47ba866dbe3e119305a6a74b607a64c4a3ac6

  • SHA512

    393abe5312933948a7be05ca88f9e370862753a94a01478b6c8b57d1f4b031097b3a41dfdb43578526491d3b9ee8bfac6ff1c20bc989fed61294361adf177bc9

  • SSDEEP

    3072:xe8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP4UZ0b2gT+wAqE+Wpor:kXtb5KcXr7XmfgqtjhANZ0b2j

  Score

  10^/10

  asyncratstormkittydefaultpersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1