Extracted

• • Target

    CrashSmash.exe

  • Size

    264KB

  • MD5

    7c64ffb6d4b7fed10d9bc6c136ddcec4

  • SHA1

    47b489693fe17be57f35abf272497f0d6abc1ca2

  • SHA256

    6da2792e0500e75c0ce3b07c8cbfbc77d6b9e07260e5d28ca1a48d61df14c380

  • SHA512

    5f48d0b4375e583582196b09cd8cb6c600b35e1df1607a4757aa91656312400dbe6a6fa1a71e4a525ae6830271c949746d27b6465bb9cb8ae8aaf8698d1ea261

  • SSDEEP

    6144:qXtb5KcXr7XmfgqtjhAxZ0b2lDG/PHhiZC:EKcXrCf/QlZ

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2