Overview

overview

10

Static

static

1

trwsfg.ps1

windows7-x64

3

trwsfg.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    trwsfg.ps1

  • Size

    1KB

  • Sample

    250101-jm4jbs1qdq

  • MD5

    22bae550672a11587c37ebb8dabeefef

  • SHA1

    5c7951317700fd35bbfd39499473889c752f9164

  • SHA256

    569775b523c853aa351d5832df2fdbb68fdaa8c05f9cc67289921f00a66c0157

  • SHA512

    03f9028156f1ba8f4ee62537ddba10c7f7d5ab0cee8cac17c1ae43c0c57922ed8a70d03b780142708afcae9b4eb46bb9b275e8b746061620681a57a27674e92a

Score
10/10
asyncratstormkittydiscoveryexecutionratstealer

Malware Config

Targets

    • Target

      trwsfg.ps1

    • Size

      1KB

    • MD5

      22bae550672a11587c37ebb8dabeefef

    • SHA1

      5c7951317700fd35bbfd39499473889c752f9164

    • SHA256

      569775b523c853aa351d5832df2fdbb68fdaa8c05f9cc67289921f00a66c0157

    • SHA512

      03f9028156f1ba8f4ee62537ddba10c7f7d5ab0cee8cac17c1ae43c0c57922ed8a70d03b780142708afcae9b4eb46bb9b275e8b746061620681a57a27674e92a

    Score
    10/10
    executionasyncratstormkittydiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops startup file

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks