Extracted

Extracted

• • Target

    rylo.exe

  • Size

    63KB

  • MD5

    aa7ac768a5e8b8f2a8735b5c67e2e6d2

  • SHA1

    631350d0f71fe7bb6416ac6404431f9d0876e7c4

  • SHA256

    ceb280af0cfd62587099b2401a9dbbdbc846ef32f378e5df36d43fb82f311823

  • SHA512

    6e566829c379ebcbbc52c90d7bce91d7e4b377be561d74ffb483b225a088b3c9ab2944eca1f5f16a7b1f49651ec6e3073e65d0e1a02e24a26c3057f424464bf9

  • SSDEEP

    768:/LvXPRKF4j7C78BIC8A+X+mazcBRL5JTk1+T4KSBGHmDbD/ph0oXgOeIlfSuodph:j/RKy7QxdSJYUbdh9gwIuodpqKmY7

  Score

  10^/10

  asyncratstealeriumstormkittydefaultcollectioncredential_accessdiscoveryexecutionpersistenceprivilege_escalationransomwareratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Renames multiple (2968) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2