Overview

overview

10

Static

static

10

IpCam Bruter.exe

windows7-x64

10

IpCam Bruter.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IpCam Bruter.exe

  • Size

    143KB

  • Sample

    240823-nbyads1aje

  • MD5

    ff94c762dc8bda27e4e75c4285ab89fa

  • SHA1

    897b8c1939ce10abf5b5b5cbc71883adb8715afe

  • SHA256

    10c0d4921910751c17d1ab6c74e48a3c9d5be28aa55b80762418765dcdcbe06c

  • SHA512

    6df88282d7898a9123459cab326881521e6ad4f39ddf8c5dbb95c0cb5635521673a1a4ada47f4f68fdb948f384912a718bb8f7cf712b5c25377493e0dba26707

  • SSDEEP

    3072:d3YO5kKdXl0ZRBL/Tuny9bdcGZcKRWpgep82z:JYO4RBTTgy9bCdX

Score
10/10
asyncratstormkittycredential_accessdiscoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Targets

    • Target

      IpCam Bruter.exe

    • Size

      143KB

    • MD5

      ff94c762dc8bda27e4e75c4285ab89fa

    • SHA1

      897b8c1939ce10abf5b5b5cbc71883adb8715afe

    • SHA256

      10c0d4921910751c17d1ab6c74e48a3c9d5be28aa55b80762418765dcdcbe06c

    • SHA512

      6df88282d7898a9123459cab326881521e6ad4f39ddf8c5dbb95c0cb5635521673a1a4ada47f4f68fdb948f384912a718bb8f7cf712b5c25377493e0dba26707

    • SSDEEP

      3072:d3YO5kKdXl0ZRBL/Tuny9bdcGZcKRWpgep82z:JYO4RBTTgy9bCdX

    Score
    10/10
    asyncratstormkittycredential_accessdiscoverypersistenceprivilege_escalationratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks