Extracted

• • Target

    Meta.v3.0.cracked.rar

  • Size

    6.1MB

  • MD5

    80f0209c71e159a12b284e9070782736

  • SHA1

    6ebcec184f833642c8be195f0299e3c36d8ddbd2

  • SHA256

    661958d0aa5bf8ac6fbc5c6bae19df1047041fa64819d523b4d10e6c922e26cf

  • SHA512

    fed7a1b5f686b4ffa2a8ae191a8c21e345033a7773fad2b2b1cf35887659e4b7797a73e27790023fe59a32a587f66ed2e338f9d168450e7cb0a36bfb2a0c954f

  • SSDEEP

    98304:sLr46ag4zz8RUciao7lMPVpIUoOdHZAqSRGMIqMOUwHcJ0DfkzKWLKXKgL/b:Qjag4zoigpIUBHoRUOUwE9GXagv

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationransomwareratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1