General

  • Target

    Infected.exe

  • Size

    63KB

  • Sample

    250216-cwqkhaxlbr

  • MD5

    caa7283ab71204b4b747a7f35f9d8a9b

  • SHA1

    6373f0c8341dc5fb5e6ba98e366c7ac061ddf2b9

  • SHA256

    12398cccbc75380eff65f0d6c44df75ff13dc4fef06f40fd558b7f4cfdf1bc7b

  • SHA512

    b6bdbbc5669ed35f3ffdcfda790ee09ae452a24b68e3055f53822acf7b0da2fad1ac6ee6ecacbcb37df06c98d86d6c5e88ab696189c92cc23ba57c4331bd2e00

  • SSDEEP

    768:l/XgYSjOTc+O78SAC8A+XO6azcBRL5JTk1+T4KSBGHmDbD/ph0oXpXPSu9ydpqKX:l4N+ltdSJYUbdh9pX6u9ydpqKmY7

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:53648

letter-organisms.gl.at.ply.gg:53648

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Infected.exe

    • Size

      63KB

    • MD5

      caa7283ab71204b4b747a7f35f9d8a9b

    • SHA1

      6373f0c8341dc5fb5e6ba98e366c7ac061ddf2b9

    • SHA256

      12398cccbc75380eff65f0d6c44df75ff13dc4fef06f40fd558b7f4cfdf1bc7b

    • SHA512

      b6bdbbc5669ed35f3ffdcfda790ee09ae452a24b68e3055f53822acf7b0da2fad1ac6ee6ecacbcb37df06c98d86d6c5e88ab696189c92cc23ba57c4331bd2e00

    • SSDEEP

      768:l/XgYSjOTc+O78SAC8A+XO6azcBRL5JTk1+T4KSBGHmDbD/ph0oXpXPSu9ydpqKX:l4N+ltdSJYUbdh9pX6u9ydpqKmY7

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Stormkitty family

    • Downloads MZ/PE file

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks