Extracted

• • Target

    SMTP-CRACKED.rar

  • Size

    66KB

  • MD5

    dc7f190edab0cf0aae00f3aa79b972b5

  • SHA1

    b38effbdeb851cba3b9350368c3bebebec58d76d

  • SHA256

    4c4a0d9390fff1001cacdb197801dbe33f3cc788a12b77a65161bf8a98b3072a

  • SHA512

    f28503cafb1b480a0662611d9a5b10817c367337170b8a96ae5b13e7b49f6e365fdcaca14c8db635a477773dfa579142e819776212d17107100264b5e29ac911

  • SSDEEP

    1536:vnXYn22OGlD9XGx8sGpynKrLZ1qBubsApAceh4rL:I/OqdAGIKHhbsApAcBP

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistencephishingprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Async RAT payload

    rat

  • A potential corporate email address has been identified in the URL: WorldWindProResultsDate2024111731024PMSystemWindows11Pro64BitUsernameAdminCompNameOKUUPVQNLanguageenUSAntivirusNotinstalledHardwareCPU12thGenIntelRCoreTMi512400GPUMicrosoftBasicDisplayAdapterRAM16154MBHWIDUnknownPowerNoSystemBattery1Screen1280x720NetworkGatewayIP10.127.0.1InternalIP10.127.0.168ExternalIP181.215.176.83BSSID7aac0b2eeb57DomainsinfoBankLogsNodataCryptoLogsNodataFreakyLogsNodataLogsBookmarks5SoftwareDeviceWindowsproductkeyDesktopscreenshotFileGrabberSourcecodefiles1Databasefiles7Documents1TelegramChannel@XSplinter

    phishing

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1