General

  • Target

    Aurora-Stealer-main.zip

  • Size

    19.9MB

  • Sample

    241029-p99lrawalp

  • MD5

    1ee8ee4451acbed67105936ee445a5ac

  • SHA1

    1382a2cda3cf2a288fd7b842f25bdeb500314cb1

  • SHA256

    62c6c51f713099e34da161990866e9e9f29495819cb176c914119a09a29a7c1f

  • SHA512

    d48586bc86846d1f6c70ff37bf84a5691ed1d59ac49d6a327d58aa40a751e3b8aef0e383f5c8b11501d453e193723935a31fda7d943413f2b61315a9321054e9

  • SSDEEP

    393216:/DjvrXK10QzlBD5Z6qQPTgH5YQhohyPovOtBPfjbPmGD3ObxcYzvvT7Ycgp4Yn:7jvrauQzDrQrgCQhSycOtNBy3vKp4Yn

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

Mutex

hwqarkrmtsomtkbpmu

Attributes
  • delay

    1

  • install

    true

  • install_file

    MpDefenderCoreService.exe

  • install_folder

    %Temp%

aes.plain
aes.plain
aes.plain

Targets

    • Target

      Aurora-Stealer-main.zip

    • Size

      19.9MB

    • MD5

      1ee8ee4451acbed67105936ee445a5ac

    • SHA1

      1382a2cda3cf2a288fd7b842f25bdeb500314cb1

    • SHA256

      62c6c51f713099e34da161990866e9e9f29495819cb176c914119a09a29a7c1f

    • SHA512

      d48586bc86846d1f6c70ff37bf84a5691ed1d59ac49d6a327d58aa40a751e3b8aef0e383f5c8b11501d453e193723935a31fda7d943413f2b61315a9321054e9

    • SSDEEP

      393216:/DjvrXK10QzlBD5Z6qQPTgH5YQhohyPovOtBPfjbPmGD3ObxcYzvvT7Ycgp4Yn:7jvrauQzDrQrgCQhSycOtNBy3vKp4Yn

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Stormkitty family

    • Async RAT payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks