Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    2.2MB

  • Sample

    241208-wfp4kswjer

  • MD5

    3541c1ac26eb5bbb87f01c20fd9f8824

  • SHA1

    bf5d136c911491f59bdeb3bf37b8f1a155fd3a97

  • SHA256

    b7cd929ce4d0fa849eeab8a216e1333f63c7d3530da674f163efab4dae3439d1

  • SHA512

    babc17723d2389919acd96f977821d57bdd737f01a9598209efafa72ae0418e914a5d229f196d80cb5ba70ce82b0f340b18aa255bbe4ed77d821a432d5794a93

  • SSDEEP

    49152:pHx/9iRLusgfLziEqFhJ5v96Adh3BeNHdbOTPixC30tP0MQ:DURLyU95JdhGda7wcM

Score
10/10
asyncratstormkittydiscoverypersistenceratstealer

Malware Config

Targets

    • Target

      file.exe

    • Size

      2.2MB

    • MD5

      3541c1ac26eb5bbb87f01c20fd9f8824

    • SHA1

      bf5d136c911491f59bdeb3bf37b8f1a155fd3a97

    • SHA256

      b7cd929ce4d0fa849eeab8a216e1333f63c7d3530da674f163efab4dae3439d1

    • SHA512

      babc17723d2389919acd96f977821d57bdd737f01a9598209efafa72ae0418e914a5d229f196d80cb5ba70ce82b0f340b18aa255bbe4ed77d821a432d5794a93

    • SSDEEP

      49152:pHx/9iRLusgfLziEqFhJ5v96Adh3BeNHdbOTPixC30tP0MQ:DURLyU95JdhGda7wcM

    Score
    10/10
    asyncratstormkittydiscoverypersistenceratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks