Extracted

• • Target

    e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe

  • Size

    760KB

  • MD5

    d2b8506820fe3c39b6b5e891170f3451

  • SHA1

    30f6fa21f06d99b0254fa1ff387c45921317eda7

  • SHA256

    e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480

  • SHA512

    15b10c694ff797b8ffbcde18752c2df2d16f961d367794df7f8932bb5bc861faef9984b6b780910eb28c5e1caaa302a0d39d9ca44fb988e84a232d24b7f28781

  • SSDEEP

    12288:YjlIpHtMPku+l0CPPoJts5Pic17D44ehsA4iFMZUiqrbA8yJNB:YjlIhSPd+pWtAPic17Dehx442B

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2