Overview

overview

10

Static

static

3

b7cd929ce4...d1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3541c1ac26eb5bbb87f01c20fd9f8824.bin

  • Size

    2.2MB

  • Sample

    241210-bgxvlasrdn

  • MD5

    cd64cde750c6a302ddcb7bf9bd6387e2

  • SHA1

    8cc45841cebea3c55445ea3e0b4f8e57f5f68a80

  • SHA256

    75d8cbfff9ef383cc77a1d5c83e113df52e087551a26a500982bc85dcfa40715

  • SHA512

    31ed69f93bcb8e3c72a37e192b4c746d8c80f2f410a25d75b03e17ed6edf5662f82631269d0a67413d1774642886bbcda591f4310c0a8f45e3dd4c7f8edbf402

  • SSDEEP

    49152:NAujLsDZUNd38PeehAzNAbC+w1CJHgA8Op9pjGQ2eyxC4:nLEuH82erbCp1Ol8OpCQ2eSC4

Score
10/10
asyncratstormkittydiscoverypersistenceratstealer

Malware Config

Targets

    • Target

      b7cd929ce4d0fa849eeab8a216e1333f63c7d3530da674f163efab4dae3439d1.exe

    • Size

      2.2MB

    • MD5

      3541c1ac26eb5bbb87f01c20fd9f8824

    • SHA1

      bf5d136c911491f59bdeb3bf37b8f1a155fd3a97

    • SHA256

      b7cd929ce4d0fa849eeab8a216e1333f63c7d3530da674f163efab4dae3439d1

    • SHA512

      babc17723d2389919acd96f977821d57bdd737f01a9598209efafa72ae0418e914a5d229f196d80cb5ba70ce82b0f340b18aa255bbe4ed77d821a432d5794a93

    • SSDEEP

      49152:pHx/9iRLusgfLziEqFhJ5v96Adh3BeNHdbOTPixC30tP0MQ:DURLyU95JdhGda7wcM

    Score
    10/10
    asyncratstormkittydiscoverypersistenceratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks