General
-
Target
e9e1e8347cecca08fc496fb051e277bfbb89b4b9f98f26d219e52667cc848a9e
-
Size
175KB
-
Sample
241212-xq6dzswlaq
-
MD5
8e882fffa5e9d66858bc250c4f002d80
-
SHA1
af8463b1b5c86b21b4ebaa60943bc67b0076b932
-
SHA256
e9e1e8347cecca08fc496fb051e277bfbb89b4b9f98f26d219e52667cc848a9e
-
SHA512
93e9e84ce19022be9f73906d2c6348714d50721ef72d436e0237ef6f79451ede1d11f5e2222a0e75bc418dc415955e1fbdb07b340de9d33ecc67e22da3ac582f
-
SSDEEP
3072:Ke8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gTQwAqE+Wpor:LXtb5KcXr7XmfgqtjhAxZ0b2N
Behavioral task
behavioral1
Sample
e9e1e8347cecca08fc496fb051e277bfbb89b4b9f98f26d219e52667cc848a9e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e9e1e8347cecca08fc496fb051e277bfbb89b4b9f98f26d219e52667cc848a9e.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7845315654:AAEzDXDA-CRGwrkUWmfqictGmbeKbuLInEs/sendMessage?chat_id=5008804138
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
e9e1e8347cecca08fc496fb051e277bfbb89b4b9f98f26d219e52667cc848a9e
-
Size
175KB
-
MD5
8e882fffa5e9d66858bc250c4f002d80
-
SHA1
af8463b1b5c86b21b4ebaa60943bc67b0076b932
-
SHA256
e9e1e8347cecca08fc496fb051e277bfbb89b4b9f98f26d219e52667cc848a9e
-
SHA512
93e9e84ce19022be9f73906d2c6348714d50721ef72d436e0237ef6f79451ede1d11f5e2222a0e75bc418dc415955e1fbdb07b340de9d33ecc67e22da3ac582f
-
SSDEEP
3072:Ke8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gTQwAqE+Wpor:LXtb5KcXr7XmfgqtjhAxZ0b2N
-
Asyncrat family
-
StormKitty payload
-
Stormkitty family
-
A potential corporate email address has been identified in the URL: WorldWindProResultsDate2024121270437PMSystemWindows10Pro64BitUsernameAdminCompNameKBKWGEBKLanguageenUSAntivirusNotinstalledHardwareCPU12thGenIntelRCoreTMi512400GPUMicrosoftBasicDisplayAdapterRAM16154MBHWIDUnknownPowerNoSystemBattery1Screen1280x720NetworkGatewayIP10.127.0.1InternalIP10.127.1.236ExternalIP181.215.176.83BSSID128405d1a05bDomainsinfoBankLogsNodataCryptoLogsNodataFreakyLogsNodataLogsBookmarks5SoftwareDeviceWindowsproductkeyDesktopscreenshotFileGrabberDatabasefiles6TelegramChannel@XSplinter
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1