Overview

overview

10

Static

static

1

file01.ps1

windows7-x64

3

file01.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file01.ps1

  • Size

    49B

  • Sample

    241231-apqwksvrgn

  • MD5

    0758afe276a0b0cd5f4f152b256c2bb4

  • SHA1

    bac13aeb38a66e5df9add1b542cc10a2165dcf35

  • SHA256

    e35d7ef701e2a95c6a9f13e379aeb8aac96dd99573e02d87daee3dd120322bce

  • SHA512

    919d93999119f069490b03bcb5153a3f35cd43d1814d1b924ea422c6d6528ff8e78b3643507993f8950c78fe0290cc1c23a0e709fb5854f6ddae2d7802576f8d

Score
10/10
asyncratstormkittydiscoveryexecutionratstealer

Malware Config

Targets

    • Target

      file01.ps1

    • Size

      49B

    • MD5

      0758afe276a0b0cd5f4f152b256c2bb4

    • SHA1

      bac13aeb38a66e5df9add1b542cc10a2165dcf35

    • SHA256

      e35d7ef701e2a95c6a9f13e379aeb8aac96dd99573e02d87daee3dd120322bce

    • SHA512

      919d93999119f069490b03bcb5153a3f35cd43d1814d1b924ea422c6d6528ff8e78b3643507993f8950c78fe0290cc1c23a0e709fb5854f6ddae2d7802576f8d

    Score
    10/10
    executionasyncratstormkittydiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops startup file

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks