Overview

overview

10

Static

static

1

malicious_..._1.ps1

windows7-x64

3

malicious_..._1.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    malicious_script_1.ps1

  • Size

    2KB

  • Sample

    250102-s4s9cszlcm

  • MD5

    a19cff86bcb8ba356ca034582a53f870

  • SHA1

    d9a1cf4e9125ab420ebb614f67cb81c6efed1afb

  • SHA256

    ae7811c08d45da31fecb2a31c6491459765667f12bc187abaf40db75755e4b1a

  • SHA512

    4c5e9fb74d890d1b69f1ebc2fc5daae20229f69bee3f4a1e26b8f9465812f39555de5e15dcbda7b1fc3a6c6042dca05d57b4591cd2f545935d8d5e4a75d4e9a6

Score
10/10
asyncratstormkittyvenomratdiscoveryexecutionratstealer

Malware Config

Targets

    • Target

      malicious_script_1.ps1

    • Size

      2KB

    • MD5

      a19cff86bcb8ba356ca034582a53f870

    • SHA1

      d9a1cf4e9125ab420ebb614f67cb81c6efed1afb

    • SHA256

      ae7811c08d45da31fecb2a31c6491459765667f12bc187abaf40db75755e4b1a

    • SHA512

      4c5e9fb74d890d1b69f1ebc2fc5daae20229f69bee3f4a1e26b8f9465812f39555de5e15dcbda7b1fc3a6c6042dca05d57b4591cd2f545935d8d5e4a75d4e9a6

    Score
    10/10
    executionasyncratstormkittyvenomratdiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks