Overview

overview

10

Static

static

3

ad50fbeb07...0f.exe

windows7-x64

10

ad50fbeb07...0f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad50fbeb07b058ac473e89fb7b0c972ce6579e3927d3142cc43418f82ef5410f.zip

  • Size

    205KB

  • Sample

    241001-tkvthssckb

  • MD5

    6d45b3dadb4d2da56dd5208d2beee397

  • SHA1

    e0ad9a5b51ff3bcf64949bb1c153a6ad8c819db4

  • SHA256

    a6c79c4ba510f8263cf18195e3b20537b820a316ea3eb3bf8f8fab2f2b27b84c

  • SHA512

    8dbd6a267ee9cfc30475d679fdf80294529cda1f79cd017a4f753fa0fc7f7b716d58d37f1b6de1fd2983a7a1254302331e9fc60d468da3b414549aacff9c3e01

  • SSDEEP

    6144:83gLaAYQ8K2pfCFL+uMntO6l+S4qxiumiYOsads:8QLjh2pGctb+ExiumuW

Score
10/10
asyncratstormkittydiscoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Targets

    • Target

      ad50fbeb07b058ac473e89fb7b0c972ce6579e3927d3142cc43418f82ef5410f

    • Size

      263KB

    • MD5

      5c8af2740a5828f8280b7e5cd4a2d851

    • SHA1

      77c382783298daa74ce37c09ef56bdd3d67bb795

    • SHA256

      ad50fbeb07b058ac473e89fb7b0c972ce6579e3927d3142cc43418f82ef5410f

    • SHA512

      d6e79b3ba49dadadbfd32f281e4e61a35ba283f805b3457f5d54026cf6fe91bad11d5b0e1ef3d27fa5921bb92920072bf0aa7fbd7042fdf2ea6e3ee9f1dc6202

    • SSDEEP

      6144:ZDKW1Lgbdl0TBBvjc/1yeZNJfyUg5aXoFtKGzchQrvILv+:Jh1Lk70TnvjcNy2yUg5aXGwGYQrva+

    Score
    10/10
    stormkittydiscoverypersistenceprivilege_escalationspywarestealerasyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks