Extracted

Extracted

• • Target

    Server.exe

  • Size

    920KB

  • MD5

    b36dc7511b95419ea3491a60597280ed

  • SHA1

    8caa07eda2ef7f77c09df3d6d9eb99190c8d6c7b

  • SHA256

    d98c45c9a36b59116af3e7311570fbf2fd18a70e669a980a3da5a1d06b1b5179

  • SHA512

    ba71404887ecd9602fd2ac6dfb4870925e0dd16b1a7c1d5c64101d6be08a20af255655679b1ce7acc11562bab464bbdd146efcad44ff67115c9df0d23d304ca0

  • SSDEEP

    12288:4MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V94iwQiKDKqxAs:4nsJ39LyjbJkQFMhmC+6GD94hKeqf

  Score

  10^/10

  asyncratstormkittyxreddefaultbackdoordiscoverypersistencephishingprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Async RAT payload

    rat

  • A potential corporate email address has been identified in the URL: WorldWindProResultsDate2024092831137AMSystemWindows10Pro64BitUsernameAdminCompNameGKUTWGDFLanguageenUSAntivirusWindowsDefender.HardwareCPU12thGenIntelRCoreTMi512400GPUMicrosoftBasicDisplayAdapterRAM16154MBHWIDUnknownPowerNoSystemBattery1Screen1280x720NetworkGatewayIP10.127.0.1InternalIP10.127.1.107ExternalIP138.199.29.44BSSID8e811dec3eaaDomainsinfoBankLogsNodataCryptoLogsNodataFreakyLogsNodataLogsBookmarks5SoftwareDeviceWindowsproductkeyDesktopscreenshotFileGrabberDatabasefiles6TelegramChannel@XSplinter

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2behavioral3