Extracted

• • Target

    updater.exe

  • Size

    232KB

  • MD5

    50e5f40aee9ed03617394cda8ecc0f4e

  • SHA1

    f79e10da26389e629c0d52ed2a4ad4755c161a1f

  • SHA256

    3d454f7a59c5b36847a8a92812bb57202bf77b800d9b4aa1d67f9c28614a5afa

  • SHA512

    59988efb8d98297c33d329aa5af1ca8c36a22c68da9bd19b18c16ef75ca2cd2aca02a566e5330f9d6c1f89c466ada25406ad366e2be7447eacfe1324bb226b83

  • SSDEEP

    6144:cDubaBBOBIIj6HLLYLCYJqvc1D6L/qfNNHbgESNLspaGr4ZyHOnxFL:9ba5LmLcEUwYGAyHcb

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2