Overview

overview

10

Static

static

10

4.exe

windows7-x64

10

4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4.exe

  • Size

    63KB

  • Sample

    240711-cq22cawbqh

  • MD5

    910f96ec798932aaa9902a0e58a45abe

  • SHA1

    5a2c806f21b9cba3abf745e2fd2b09e4313dcc36

  • SHA256

    03fa1a87d4065499ab338c94976e19bf53d95e4a655ff598da6fe4d4cd85e861

  • SHA512

    345794e886be99bc80f1ac200601da680e07dd660d4a5581c1d7d8573f6aa62bc2f41255a64bdb3697ae6b012e716a591c6acc98df09d150cd500dd6a370e68d

  • SSDEEP

    768:LnuguX1wbgyX78dIC8A+Xky7NirX8RvKq1+T4+SBGHmDbDtph0oXZutYhfqSu8dP:jvCCPTT7c8IqNYUbXh9lBdu8dpqKmY7

Score
10/10
asyncratstealeriumstormkittydefaultcollectionpersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

147.185.221.21:6643

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      4.exe

    • Size

      63KB

    • MD5

      910f96ec798932aaa9902a0e58a45abe

    • SHA1

      5a2c806f21b9cba3abf745e2fd2b09e4313dcc36

    • SHA256

      03fa1a87d4065499ab338c94976e19bf53d95e4a655ff598da6fe4d4cd85e861

    • SHA512

      345794e886be99bc80f1ac200601da680e07dd660d4a5581c1d7d8573f6aa62bc2f41255a64bdb3697ae6b012e716a591c6acc98df09d150cd500dd6a370e68d

    • SSDEEP

      768:LnuguX1wbgyX78dIC8A+Xky7NirX8RvKq1+T4+SBGHmDbDtph0oXZutYhfqSu8dP:jvCCPTT7c8IqNYUbXh9lBdu8dpqKmY7

    Score
    10/10
    asyncratdefaultratstealeriumstormkittycollectionpersistenceprivilege_escalationspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

      stealerstealerium

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks