Extracted

• • Target
    e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe
  • Size 760KB
  • SHA256 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480
  • MD5 d2b8506820fe3c39b6b5e891170f3451
  • SHA1 30f6fa21f06d99b0254fa1ff387c45921317eda7
  • SHA512 15b10c694ff797b8ffbcde18752c2df2d16f961d367794df7f8932bb5bc861faef9984b6b780910eb28c5e1caaa302a0d39d9ca44fb988e84a232d24b7f28781
  • SSDEEP 12288:YjlIpHtMPku+l0CPPoJts5Pic17D44ehsA4iFMZUiqrbA8yJNB:YjlIhSPd+pWtAPic17Dehx442B
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9