Overview

overview

10

Static

static

3

ad822394ec...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad822394ecd393272d3d1ba77306e502ee90259f4c328dab80e9d6b5e4bd363f.exe

  • Size

    2.2MB

  • Sample

    241209-c7hn2atken

  • MD5

    1d3f1b333a438438193b1d29731fd607

  • SHA1

    0c8852028d925fc940ad1fcccc7539bf3c0db92c

  • SHA256

    ad822394ecd393272d3d1ba77306e502ee90259f4c328dab80e9d6b5e4bd363f

  • SHA512

    b9008ef7fc8aadc92fe20df3d3081a06bc561491b3aaac35caaf256f136e8c95c248d1622112ef08cc415f0b6efe10055b4cc31d9b1f88b508c64b688e8f561d

  • SSDEEP

    49152:C3YMeBr/pNfVrjepcpNHrMS0p1K4Gsu08+nzgc:IeBr/pNfVvepwaR

Score
10/10
asyncratstormkittydiscoverypersistenceratstealer

Malware Config

Targets

    • Target

      ad822394ecd393272d3d1ba77306e502ee90259f4c328dab80e9d6b5e4bd363f.exe

    • Size

      2.2MB

    • MD5

      1d3f1b333a438438193b1d29731fd607

    • SHA1

      0c8852028d925fc940ad1fcccc7539bf3c0db92c

    • SHA256

      ad822394ecd393272d3d1ba77306e502ee90259f4c328dab80e9d6b5e4bd363f

    • SHA512

      b9008ef7fc8aadc92fe20df3d3081a06bc561491b3aaac35caaf256f136e8c95c248d1622112ef08cc415f0b6efe10055b4cc31d9b1f88b508c64b688e8f561d

    • SSDEEP

      49152:C3YMeBr/pNfVrjepcpNHrMS0p1K4Gsu08+nzgc:IeBr/pNfVvepwaR

    Score
    10/10
    asyncratstormkittydiscoverypersistenceratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks