Extracted

Extracted

• • Target

    63d2c37fdb370cf6e743bd75e7408f5eded5bc823a29401eeafe0bea921657bb

  • Size

    1.7MB

  • MD5

    b7ca45674c6b8a24a6a71315e0e51397

  • SHA1

    79516b1bd2227f08ff333b950dafb29707916828

  • SHA256

    63d2c37fdb370cf6e743bd75e7408f5eded5bc823a29401eeafe0bea921657bb

  • SHA512

    f390c2d017c041b60c57a67508341512785efbd25cb93a5c2849b4a5adb52931ea92eca7bbbef3e0cae0c919525770582e4c5e2518033c1c61542c0c2c1ebf2f

  • SSDEEP

    24576:iRJSuMgl+JTBJ5aB3KoWWbHcXThtehTl5O9TLb:0IEFd/CTqR8P

  Score

  10^/10

  asyncratnjratstormkittydefaulthackedevasionpersistenceprivilege_escalationratstealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2