Extracted

• • Target

    17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe

  • Size

    170KB

  • MD5

    236d3fc78c734bbc2f6e99e366083dc0

  • SHA1

    ac105cc15e018a99d82121a11852484b72d9e450

  • SHA256

    17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411e

  • SHA512

    1db08c95c35e1279892c2c9a24b6387cb0e7775885156fa6bc6ce32655620566bf4c4470cc8538f896badd18df0ccf2f6d14f9d91430728298a9b4085351cc19

  • SSDEEP

    3072:S+STW8djpN6izj8mZwOI03cMErxe2SlkIPu/i9bSJ2c1ac6+WpP:P8XN6W8mmOI03c7ylJPSi9b6X

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2