Overview

overview

10

Static

static

1

iubn.ps1

windows7-x64

8

iubn.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iubn.ps1

  • Size

    1KB

  • Sample

    250102-wtqx2azqhy

  • MD5

    1ec2c58c17fc606446451058a6961972

  • SHA1

    abfd1b16246bcce8721d2c5aa85cfa354135f2ff

  • SHA256

    5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196

  • SHA512

    7365d26c3b74e25d18618d3042ff98fedae2d1e5db6f2c6d0a7034582141a78e5c2df949477c1169e471ced3fcf94d660b7cd8655ecd6bda2d803f1ecc0c0f17

Score
10/10
asyncratstormkittydiscoveryexecutionratstealer

Malware Config

Targets

    • Target

      iubn.ps1

    • Size

      1KB

    • MD5

      1ec2c58c17fc606446451058a6961972

    • SHA1

      abfd1b16246bcce8721d2c5aa85cfa354135f2ff

    • SHA256

      5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196

    • SHA512

      7365d26c3b74e25d18618d3042ff98fedae2d1e5db6f2c6d0a7034582141a78e5c2df949477c1169e471ced3fcf94d660b7cd8655ecd6bda2d803f1ecc0c0f17

    Score
    10/10
    executionasyncratstormkittydiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks