General
-
Target
40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
-
Size
175KB
-
Sample
241211-vgr4wswlfm
-
MD5
19f436930646f3e8f283fa71f2a4cbcb
-
SHA1
99397666d23ddde6078496ee73bde00ae9403393
-
SHA256
40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff
-
SHA512
addba9ff5bd334ddfec06f87d2c69c06028b82d0aab732f73ef35e84f46d889f48ab6823371a9b9f415e2758e62270866682b833bca7406354802e0157314e0d
-
SSDEEP
3072:+e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTDwARE+WpCc:W6ewwIwQJ6vKX0c5MlYZ0b2E
Behavioral task
behavioral1
Sample
40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
-
Size
175KB
-
MD5
19f436930646f3e8f283fa71f2a4cbcb
-
SHA1
99397666d23ddde6078496ee73bde00ae9403393
-
SHA256
40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff
-
SHA512
addba9ff5bd334ddfec06f87d2c69c06028b82d0aab732f73ef35e84f46d889f48ab6823371a9b9f415e2758e62270866682b833bca7406354802e0157314e0d
-
SSDEEP
3072:+e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTDwARE+WpCc:W6ewwIwQJ6vKX0c5MlYZ0b2E
-
Asyncrat family
-
StormKitty payload
-
Stormkitty family
-
A potential corporate email address has been identified in the URL: WorldWindProResultsDate2024121145859PMSystemWindows10Pro64BitUsernameAdminCompNameGYHASOLSLanguageenUSAntivirusNotinstalledHardwareCPU12thGenIntelRCoreTMi512400GPUMicrosoftBasicDisplayAdapterRAM16154MBHWIDUnknownPowerNoSystemBattery1Screen1280x720NetworkGatewayIP10.127.0.1InternalIP10.127.0.118ExternalIP181.215.176.83BSSID86f6f41d1b6dDomainsinfoBankLogsNodataCryptoLogsNodataFreakyLogsNodataLogsBookmarks5SoftwareDeviceWindowsproductkeyDesktopscreenshotFileGrabberDatabasefiles6TelegramChannel@XSplinter
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1