Overview

overview

10

Static

static

1

5e8a676a5b...96.ps1

windows7-x64

8

5e8a676a5b...96.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ec2c58c17fc606446451058a6961972.bin

  • Size

    1KB

  • Sample

    250104-bgtsyavqdp

  • MD5

    61c513f04e75eb7c8152a1b14cce39fb

  • SHA1

    65a01ea75cd502564742e06002fb8131d8938386

  • SHA256

    8b61887dff9a4f0635d45dfca88ae9e3aa5c8785bdfc17721748807fa543b85b

  • SHA512

    0a26d09bbfac6af53404e22cd51d34527933969d05185569d947f653f886d9b932d231b5e20481214b5ca1a3f8f3b116dd5a265c25c845e95f9b2ca655c2f3f9

Score
10/10
asyncratstormkittydiscoveryexecutionratstealer

Malware Config

Targets

    • Target

      5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196.ps1

    • Size

      1KB

    • MD5

      1ec2c58c17fc606446451058a6961972

    • SHA1

      abfd1b16246bcce8721d2c5aa85cfa354135f2ff

    • SHA256

      5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196

    • SHA512

      7365d26c3b74e25d18618d3042ff98fedae2d1e5db6f2c6d0a7034582141a78e5c2df949477c1169e471ced3fcf94d660b7cd8655ecd6bda2d803f1ecc0c0f17

    Score
    10/10
    executionasyncratstormkittydiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks