Extracted

• • Target

    SilverClient.exe

  • Size

    43KB

  • MD5

    16edc9184a4f2e4c18200304594d43d9

  • SHA1

    9328f1016cf247a13b110d6ece2826ba4ad5a8cf

  • SHA256

    be652d4e5771a47651e037776bbd47e90d3ab7de28e61e3c86abfc4b76c813dd

  • SHA512

    196f4c9b55d2883b4c7364aca90741a9e606952e2c798b2c4075a661768dab274b5b6683280404ff31eed98a11003991c67f7af4d61cf48dd131e7365a3cf74d

  • SSDEEP

    768:UsvI7cIxr7BcD1wjWxYQ4xJNHVR8kq/5h34vCvZPxaxP4RULQv9S6HPz1QB6Si/o:UsvwcIxrgwkbcrq/5xcl4Gsv9j71QoJg

  Score

  10^/10

  silverratstormkittydiscoveryevasionexecutionpersistenceransomwarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • SilverRat

    SilverRat is trojan written in C#.

    trojansilverrat

  • Silverrat family

    silverrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1