Overview

overview

10

Static

static

3

b9070dcf9e...a7.exe

windows7-x64

10

b9070dcf9e...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9070dcf9e13ebd0187be2084de4c3fe485cd4d38a8bc7a94420fc744fac4ba7.zip

  • Size

    205KB

  • Sample

    241001-tkxccayapq

  • MD5

    870c66d06853b75784b3498febc18d0f

  • SHA1

    03cdb9250e8732546d24cddcbfa3088d50f14c31

  • SHA256

    0bc5507459089bd447b1b84408798ccf2e3142cbce1dbba0634ed2e075e35408

  • SHA512

    48e9349d1d9a078fc6ad50a92a9779a4647798b3956f15ed1cf5ade77019d78dd8de65e5e5e4704704ae90e01cf5704428e11dad134a8eb068775c258ebc36d2

  • SSDEEP

    3072:lHk0diXJvwRi+x8ErfTPNAbR1uowwaiJRZG9rLTsVHkywH7syYA5g85P9PQJ56cS:lNuSRPnfhAiTiJVUFT5g8sUcS

Score
10/10
asyncratstormkittydiscoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Targets

    • Target

      b9070dcf9e13ebd0187be2084de4c3fe485cd4d38a8bc7a94420fc744fac4ba7

    • Size

      263KB

    • MD5

      885c72a729b202512aadc7c7a69d129d

    • SHA1

      aa79d439039050d55e6c01d116926ee3852c8d34

    • SHA256

      b9070dcf9e13ebd0187be2084de4c3fe485cd4d38a8bc7a94420fc744fac4ba7

    • SHA512

      52fd34ef5cde4ee8618774f69c8989e3e5431c2eccd226fa1b06382ad423ca897d5ba374c2ed1720fea0c58e777f41ba435e02867d446a216b1871933fd25a0b

    • SSDEEP

      6144:IDKW1Lgbdl0TBBvjc/DnMugecPSgoUS/ySQha:Oh1Lk70TnvjcwugDLkySt

    Score
    10/10
    stormkittydiscoverypersistenceprivilege_escalationspywarestealerasyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks