Extracted

• • Target

    Client.exe

  • Size

    74KB

  • MD5

    6a43c7621d8e0c43bb7f14e47e589ea3

  • SHA1

    80bb90b6f984d780655744b0f057131e85f1e2d7

  • SHA256

    c18bff90f64c31c5f94d0053a5cabaecde420c5496521014e8000c67f5773b02

  • SHA512

    699f12e1eb81125970c475ee7d8440a10ceae556aa9938120efb77b6260efdc7c4c1e6b1665421a829e8fbc0870ef4ad7734fd5e639e8183a41bc2bae289f514

  • SSDEEP

    1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/6mZlSWQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bfCglSWQYBY

  Score

  10^/10

  asyncratstormkittydefaultdiscoveryevasionratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1