General
-
Target
d5e023046bdd103854180037c5c60d8e49b21e3d4fa4e41b4838c67b93bcb4a6
-
Size
175KB
-
Sample
250322-xwp9yssqy9
-
MD5
99a934470d85d4aa3862dfa0bd24dce9
-
SHA1
077256a6bcc11b1b2bda0517df388edc40f700cc
-
SHA256
d5e023046bdd103854180037c5c60d8e49b21e3d4fa4e41b4838c67b93bcb4a6
-
SHA512
b48a9faa032a1dccd387a7ca6769051cba81926412c777690845af6f6ebe9575626650ca93ca89dafba8f0c77323d467c61730d2fa529dc9c5d679fc09caa676
-
SSDEEP
3072:Ke8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTXwARE+WpCc:66ewwIwQJ6vKX0c5MlYZ0b2c
Behavioral task
behavioral1
Sample
d5e023046bdd103854180037c5c60d8e49b21e3d4fa4e41b4838c67b93bcb4a6.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
d5e023046bdd103854180037c5c60d8e49b21e3d4fa4e41b4838c67b93bcb4a6.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7555588489:AAHw7-a3svAwJ6LV5_fEyImOVVLFri7GJNU/sendMessage?chat_id=6099624922
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
d5e023046bdd103854180037c5c60d8e49b21e3d4fa4e41b4838c67b93bcb4a6
-
Size
175KB
-
MD5
99a934470d85d4aa3862dfa0bd24dce9
-
SHA1
077256a6bcc11b1b2bda0517df388edc40f700cc
-
SHA256
d5e023046bdd103854180037c5c60d8e49b21e3d4fa4e41b4838c67b93bcb4a6
-
SHA512
b48a9faa032a1dccd387a7ca6769051cba81926412c777690845af6f6ebe9575626650ca93ca89dafba8f0c77323d467c61730d2fa529dc9c5d679fc09caa676
-
SSDEEP
3072:Ke8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTXwARE+WpCc:66ewwIwQJ6vKX0c5MlYZ0b2c
-
Asyncrat family
-
StormKitty payload
-
Stormkitty family
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1