Extracted

• • Target

    Sleflistuiq.exe

  • Size

    218KB

  • MD5

    41dd4767d8c5f340b52cbc7258d45c08

  • SHA1

    7b53ec2d4c693a24745af9710ff5ad1ddb60e8c6

  • SHA256

    2720acefe611680845b583b7e060d6efeb172945ad7acba49f46ea22693a1f5e

  • SHA512

    64c3de49e3176d1cf3469043160a7e90421aaa60897b47759478a7932ab5a575465e6c88b6349f1bc06d6a8f28c7582e284fd3ae3dede48274d90338fe8c0caf

  • SSDEEP

    3072:XedQRhjdznZv+MjmRl9ZL4SD1L8G8YHTS3cerNaV7JUs8VhrMdUT5reUd6:uWRhL+Mjyv54CcYzSSYWUT5reU

  Score

  10^/10

  asyncratstormkittydefaultpersistenceratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2