Extracted

• • Target

    2025-01-25_6ad6bb9ff2600d6e03aeea4d5aaae235_icedid

  • Size

    2.0MB

  • MD5

    6ad6bb9ff2600d6e03aeea4d5aaae235

  • SHA1

    e5c72c1a2a35e01b1e9d64cf7991d86abc88cce5

  • SHA256

    047b76675a633db72c428f5c79a6b5ca5c7b3a6fbebbb7de5ec495e4cb1857af

  • SHA512

    d3da5954fb81e8d4f50fc16ff89c5627de0c3e7e2e393b3dbd4d27293ba3e1b388e92a0585a5dd9df6a10561fcd519f014b90a5257d7c2c606de21fc001db770

  • SSDEEP

    24576:SGyEQkGMex01TGQ0U7dr0hYmwFRbKOdzzmh3xtJ5GfsZOu17s:SGrdomllYOpcxckfs

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2