Extracted

• • Target

    27634323ec85c5d553d7346b1a4d7f0ee31ac2a33d755f2700db0fb9474975d2

  • Size

    757KB

  • MD5

    e4976f1a6bdfac9de40f9b8d5d5f62ba

  • SHA1

    a6003a4e3ff383baa178bd633b6b752d070ba68d

  • SHA256

    27634323ec85c5d553d7346b1a4d7f0ee31ac2a33d755f2700db0fb9474975d2

  • SHA512

    d74f211f475487193b7fc5b6cc02ffb758599815da7f2d8fd9ebf5c3deca8f4d02fc2e66531a0b7585fa9ef64ac7fed3fdbf52ee67350257468a2728e5740eb6

  • SSDEEP

    6144:cSncRl18XN6W8mmHPtppXPSi9b4fcSncRlrBoLp7ua9Qd:94UN6qatppXPm4RBYEaw

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2