Extracted

• • Target

    sigma.zip

  • Size

    4.5MB

  • MD5

    1dfeebdf82ab3ed01ddd18ab3a4650fd

  • SHA1

    d9be45847f326af2a7a1bf26945b813f1bf8df77

  • SHA256

    8aae531dd3a505f3626825ac271c6beec7f25fea3d2c90cb704d9eb9f4ece7f8

  • SHA512

    dae196c7db8ed2fbdb8c2e8469c496e48c23ce9eb4d6f31d3468b7cc169489cf1be9967ee104377403b6b53acdc92da9e030a561116eea7c15f8aef92ae1826f

  • SSDEEP

    98304:WiMbhvRrGFryU0NBkhoidjUXp5KkNbwBDl5NuMD8Pl4cOVh86y4X:9M3aFrphoPXL5hA8MDbT84X

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2