Overview

overview

10

Static

static

1

68225e21f0...9d.ps1

windows7-x64

10

68225e21f0...9d.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68225e21f08b08bd1890e8e0a5d1b379cd9692a2c4a43bffd7ea6bee5e5b409d.ps1

  • Size

    30.6MB

  • Sample

    241214-ntk3saslfj

  • MD5

    f01f7141f5dcb2161ee0701949f91e70

  • SHA1

    28d2427ee1cd5f4c2a17f020bfaea95daece07d6

  • SHA256

    68225e21f08b08bd1890e8e0a5d1b379cd9692a2c4a43bffd7ea6bee5e5b409d

  • SHA512

    6cd177e2d4b385365eb9f549d2f869f1a40483e1c8a4fe0655146c7ca28090cdf14ac9c2a8a1cb7c385f6f824fe2da422b1714cb2ca851a0d1a18cb3be2a31e1

  • SSDEEP

    49152:/0p9Wz0S8ygXipUpxf2H21a1RFvpB8ciXBXsdO6QKUP+Vzfcw3S6T3G4n/1kbC9z:5

Score
10/10
asyncratstormkittydiscoveryexecutionpersistenceratstealer

Malware Config

Targets

    • Target

      68225e21f08b08bd1890e8e0a5d1b379cd9692a2c4a43bffd7ea6bee5e5b409d.ps1

    • Size

      30.6MB

    • MD5

      f01f7141f5dcb2161ee0701949f91e70

    • SHA1

      28d2427ee1cd5f4c2a17f020bfaea95daece07d6

    • SHA256

      68225e21f08b08bd1890e8e0a5d1b379cd9692a2c4a43bffd7ea6bee5e5b409d

    • SHA512

      6cd177e2d4b385365eb9f549d2f869f1a40483e1c8a4fe0655146c7ca28090cdf14ac9c2a8a1cb7c385f6f824fe2da422b1714cb2ca851a0d1a18cb3be2a31e1

    • SSDEEP

      49152:/0p9Wz0S8ygXipUpxf2H21a1RFvpB8ciXBXsdO6QKUP+Vzfcw3S6T3G4n/1kbC9z:5

    Score
    10/10
    asyncratstormkittydiscoveryexecutionpersistenceratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks