Extracted

• • Target

    random.exe

  • Size

    846KB

  • MD5

    c3d89e95bfb66f5127ac1f2f3e1bd665

  • SHA1

    bd79a4a17cc8ad63abdde20d9de02d55d54903f9

  • SHA256

    5d07ad572a6a37d07d0b7ca990087960ad8850d7cfc56b8c7270c826c70fb56b

  • SHA512

    d85116e24cf07f3063837fab1859ae6d9313dd269e28844900cbebe7521df8c65db97bc122bb097e9887d686bdf8f786b93a06208d762fded9035d2c6448a111

  • SSDEEP

    24576:+VIFvGC3R+NVgcijiCnjWii1bAL3ztlmAQJut:Cg2VghqVRKz6AQwt

  Score

  10^/10

  discoveryasyncratstormkittydefaultratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2