Overview

overview

10

Static

static

10

Server.exe

windows7-x64

10

Server.exe

windows10-ltsc 2021-x64

10

Server.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    175KB

  • Sample

    250208-s62nhstjbs

  • MD5

    afd5b15ef7e12b0c6469d5a6e853ba7c

  • SHA1

    fd004564b996b2aa7838264322c39c3e043f83d6

  • SHA256

    7c607526feaf1f53ac61c84b4d95fba30c7209b86a0426a1b8c72dbb94ec3747

  • SHA512

    46dc3e43df92888461104f9d6579bae87fb62b318a7d0f01bad7ff643ffd649527c877769feb3fe4821ed7d99b2a45c2bdf198369be5a250cc4ad84d2ea106ce

  • SSDEEP

    3072:3e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTTwARE+WpCc:v6ewwIwQJ6vKX0c5MlYZ0b2w

Score
10/10
asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7926380598:AAFjRd_Ca7fbAplbMEhSA_VRzJUZjWDMlws/sendMessage?chat_id=6632870164
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Server.exe

    • Size

      175KB

    • MD5

      afd5b15ef7e12b0c6469d5a6e853ba7c

    • SHA1

      fd004564b996b2aa7838264322c39c3e043f83d6

    • SHA256

      7c607526feaf1f53ac61c84b4d95fba30c7209b86a0426a1b8c72dbb94ec3747

    • SHA512

      46dc3e43df92888461104f9d6579bae87fb62b318a7d0f01bad7ff643ffd649527c877769feb3fe4821ed7d99b2a45c2bdf198369be5a250cc4ad84d2ea106ce

    • SSDEEP

      3072:3e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTTwARE+WpCc:v6ewwIwQJ6vKX0c5MlYZ0b2w

    Score
    10/10
    asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks