Extracted

Extracted

Extracted

• • Target

    eBill_278146878CV.wsf

  • Size

    31KB

  • MD5

    0a7c5d3d48afcfd0665cde72c0f34056

  • SHA1

    0a54cc9c809d7e4652124594cf4c9aa5d0e69fb0

  • SHA256

    abe9c101a2935a04086558477a69ad3c2ec2a41a60ca50519c39a7db0e07d41d

  • SHA512

    c0f00e95aa2e9079ff80d80c839388ea6c7f055a764249d76f4f8933c5dcbc006892a9c46faf28ea1203541c34fb82e6557940e93b98b0b4cb371cdf0c489381

  • SSDEEP

    768:GneTE/AK58r/7LtJKyvuh9gneTE/AK58r/7LtJKyvuh9w:GGQG/dlGQG/dH

  Score

  10^/10

  asyncratstormkittygeekodiscoveryexecutionratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2