Extracted

• • Target

    14c6d942188587ff0f29679de43a2528_JaffaCakes118

  • Size

    167KB

  • MD5

    14c6d942188587ff0f29679de43a2528

  • SHA1

    79c1f96ed01592c7e65c2e00f931a157c15f28e4

  • SHA256

    7d4b5d1c4d2ac49cf030034937c48662bdb6bc3d765b2ae575d613a13c5ca46f

  • SHA512

    cd457b1f340e1dd4d8d3167208f255d0b858f5b3d16f3743702ca2f7f4aa76595135bd3f7a1cc76178bf1f1489bc4b79392c922a7a89bba2aadfb450cdd5e8d5

  • SSDEEP

    3072:XauB++hB+AYDt58T4Eu0RR61u/s9bLztDOCw9p+Wp+WIro:f7hG5y4Eug81Ss9bfsCw9dIr

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2