Extracted

• • Target

    Builder.exe

  • Size

    7.1MB

  • MD5

    479c20170f53c96f24c77610b86fa352

  • SHA1

    99c1c05a229e9b2e6f812f0fa7db4ac78c9cae1e

  • SHA256

    df814ecf5dd2f631b9b728148c00ba2973b6efbb06364c5a4f0883ddad2549ea

  • SHA512

    1c6a7e336f64283dfd2ebb3c259f84bd87f32d7d70d8783e11b45878677c3e95b45c9e7f73ae2c77d3860f95bf6cb85bf85e4fe3ca1d311f9cf153d642f27d61

  • SSDEEP

    196608:Zmx49UBA1HeT39Iig/f1ncKOVVtk7HdGtQbNPUQ:0aT1+TtIio0VQ9G6r

  Score

  10^/10

  asyncratstormkittydefaultcredential_accessdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1