Extracted

• • Target

    IChanger.exe

  • Size

    2.6MB

  • MD5

    de70283085ca45f6b19bc3beb373e970

  • SHA1

    30bcdfc110d03006ba0efd89def64628d2715ead

  • SHA256

    e828e2b51c2c5412e66a660792ef393ce52c8e31d41d9c1adcac81367728fea6

  • SHA512

    0e32b346714cf244e24ce0e6515e558c7a29157304e24f14d44ff3488486c19f9f0403fddb48dc6e95a3489eca503697d16c7e0e8e76d0e84264522af3e6d2c1

  • SSDEEP

    49152:vG4DuZSgBVz68epmUAJWrrQiODZXHBdG:e7paboUS1dX3G

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2