Extracted

• • Target

    153a321e178bc28e0f2c6432763bb44fc47b573596387ec241ca45d8775e12af.exe

  • Size

    175KB

  • MD5

    f69889d705f5d72d65661b48535ae1b3

  • SHA1

    4c8f3cf14130e6519339a370bba4527ecb012cde

  • SHA256

    153a321e178bc28e0f2c6432763bb44fc47b573596387ec241ca45d8775e12af

  • SHA512

    a182272541b22dd58d44db506f0c3368fd0e54d0e616d48b6980563eb12d8d9a377bb0d0272c0c2576d36359f10367e27043d3c3106e5d985be0843112fedb3d

  • SSDEEP

    3072:Ke8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gT8wARE+WpCc:66ewwIwQJ6vKX0c5MlYZ0b2R

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2