Overview

overview

10

Static

static

1

vfrcxq.ps1

windows7-x64

8

vfrcxq.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vfrcxq.ps1

  • Size

    1KB

  • Sample

    250101-jqy31s1ran

  • MD5

    0cdc732f0ded614eb23c08213bcf1e04

  • SHA1

    0cbca39b7b1a0ec9b930c38c1c60d50feed74ee3

  • SHA256

    7e129f68ebb1e8730941dcf50344e256bd0e32f29cac0e641426b88a17e131c6

  • SHA512

    86c92258d18f25c97215c68cd4ef09b0c1433ea9de27c00247537ea8a7c187d4428b1cb151c785d5544f17da8ba9b138ef59efd3c7f7546240bf7ae5a5b29eb7

Score
10/10
asyncratstormkittydiscoveryexecutionratstealer

Malware Config

Targets

    • Target

      vfrcxq.ps1

    • Size

      1KB

    • MD5

      0cdc732f0ded614eb23c08213bcf1e04

    • SHA1

      0cbca39b7b1a0ec9b930c38c1c60d50feed74ee3

    • SHA256

      7e129f68ebb1e8730941dcf50344e256bd0e32f29cac0e641426b88a17e131c6

    • SHA512

      86c92258d18f25c97215c68cd4ef09b0c1433ea9de27c00247537ea8a7c187d4428b1cb151c785d5544f17da8ba9b138ef59efd3c7f7546240bf7ae5a5b29eb7

    Score
    10/10
    executionasyncratstormkittydiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks