Extracted

• • Target
    kNO9ox8ymOdMytA.exe
  • Size 786KB
  • SHA256 df45889d4ef60520e6cf0d57ecf264341f0cee424179de909a77e196767d1e25
  • MD5 8c5b121b1dcea4ba96614e60bff2ef27
  • SHA1 67954205ed32f5727cfe8aab17ba03a6443a37f8
  • SHA512 679eb1c12c7054c2413d4e1d2b9409c9494e47b12627557f0d446586c0bd195e1658dbc63b2d027764bdf3104d60ef409e446179cc4c8e4171a8f6b18d773789
  • SSDEEP 12288:29S4nUFqzQoRTiaRlKH9fPz9h4QBk3qiIIb8/Li/3KaED0ZNSQP7qDoR:UvTia361z3jwqik/LYKaExQD/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratstormkittydefaultexecutionpersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2