Extracted

• • Target

    BotKiller.exe

  • Size

    6KB

  • MD5

    10d199b2efdb69ed343f5cd4044b7def

  • SHA1

    1f218983db04d9b7b31a67aeead5a94ca5d3dc80

  • SHA256

    5fbd4e2c42e19e7ee561183ca6b2ded2f8049a890951704c799e8b4a016ab817

  • SHA512

    682feb271c12a847b69f1ac92ad7d5cad18b145b64af83dbe7fd0f6282be8bf6091323ca16bc509f789a68e74e17eb1484fce907f9a0562237b40572e0e8852c

  • SSDEEP

    96:1SJmM+BVOGjYKyhp+Aloz0yD/TB2uJW9wzNt:1smHOhpdXyLEuJIS

  Score

  10^/10

  asyncratstealeriumdefaultcollectiondiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1