Overview

overview

10

Static

static

1

Cryos Woofer.exe

windows7-x64

10

Cryos Woofer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cryos Woofer.exe

  • Size

    3.2MB

  • Sample

    241207-2pp3tsxrct

  • MD5

    2129b89ba0537555b185f6fb819c0693

  • SHA1

    008c94d1dc3bcf3ae3ce4c735fad94f810b844b8

  • SHA256

    b250a8cb9042a96d90850ef165b43cd50624878916ab0dd259a577032912e055

  • SHA512

    005b4155242b4711b07e34f1435a6e7268d5d3217a44f99df6137280647d2673a078ea0d8e1f8ba192a2209777cf2ad0dc960373cceda11be0b4ecf36fc2048b

  • SSDEEP

    98304:t2BvT8knglXKHw6ub2NQOtmnuu4Yv21O5PEsOPR:t2ZYPGPzQ0muu4Yv/PROPR

Score
10/10
asyncratstormkittydiscoveryratstealer

Malware Config

Targets

    • Target

      Cryos Woofer.exe

    • Size

      3.2MB

    • MD5

      2129b89ba0537555b185f6fb819c0693

    • SHA1

      008c94d1dc3bcf3ae3ce4c735fad94f810b844b8

    • SHA256

      b250a8cb9042a96d90850ef165b43cd50624878916ab0dd259a577032912e055

    • SHA512

      005b4155242b4711b07e34f1435a6e7268d5d3217a44f99df6137280647d2673a078ea0d8e1f8ba192a2209777cf2ad0dc960373cceda11be0b4ecf36fc2048b

    • SSDEEP

      98304:t2BvT8knglXKHw6ub2NQOtmnuu4Yv21O5PEsOPR:t2ZYPGPzQ0muu4Yv/PROPR

    Score
    10/10
    asyncratstormkittydiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks