Extracted

• • Target

    Infected.exe

  • Size

    63KB

  • MD5

    9946d546b012e2ae18dd4e7614ce200a

  • SHA1

    c6447183bdb1db024d5c263745ab07b99399bc73

  • SHA256

    93f9787fddb2cf2d02f5e28432e9235ad726114c6821d50b6b29affd7ccf1440

  • SHA512

    fdba49f0879b613a19352130fc0d2725b84ffd5ef9dcb111e5cf46ada4e05478099c8796b12a315a1209f4a58873e454e543dd68a06a5846218717faf098ef1b

  • SSDEEP

    768:/LQXPRKF4j7C78BIC8A+X+mazcBRL5JTk1+T4KSBGHmDbD/ph0oX25QqSuodpqKX:k/RKy7QxdSJYUbdh9sQduodpqKmY7

  Score

  10^/10

  asyncratstealeriumstormkittyrattersdiscoveryransomwareratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Async RAT payload

    rat

  • Renames multiple (1275) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1