Extracted

• • Target

    SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.31219.13466.exe

  • Size

    469KB

  • MD5

    3c69297a420b00c660113d44eb039254

  • SHA1

    dc8212328e6dd88e713efb161ecaa3fe25d1eb0f

  • SHA256

    142873db547e46701d0630bf254b6e4d7570a37e62194e89264b53410682d9a8

  • SHA512

    70c3e84356bfc0798cb35b42907a64428d08b5816da7b30c7fe365f1c63f6312c68569b3b58e19f90539cc1bdb9a553346c92705ab0363c321b2ae16f3077e63

  • SSDEEP

    12288:9JRUxMAcD2Im3x3I1luJwZrFhwJbAWqpI0:9JRUxjcD2Igh2lj20I0

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionratstormkittystealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2