Overview

overview

10

Static

static

3

2025-04-04...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-04_858a8298df3f289376bd4903c6f2ab7a_black-basta_luca-stealer

  • Size

    6.0MB

  • Sample

    250404-3tl3eayp16

  • MD5

    858a8298df3f289376bd4903c6f2ab7a

  • SHA1

    9467aa77a2d368ed7593305f3bd20ff984129595

  • SHA256

    ffc2c34d728009ffcdbce2fdb7a700516165f0ca449672174e9cebf78bb52bc9

  • SHA512

    4204ef3ea6917d68371c5ecdf5df0780b2b9a2b16262f94a0f60724b8ec97c9a33697a4a9793766013abb81a86ea348812291ec83f6ed2074aa5e054f8d25a77

  • SSDEEP

    98304:NMuUL5ne9zxKYgY7hy4d96G0e+hFhxgzTQpW11w65G1OR5B8J8gID1aNFO9Y:NMu2eNUYg0Eeqs/GMLN5B8JWBGFO9Y

Score
10/10
asyncratstormkittyvenomratdiscoverypersistenceratstealer

Malware Config

Targets

    • Target

      2025-04-04_858a8298df3f289376bd4903c6f2ab7a_black-basta_luca-stealer

    • Size

      6.0MB

    • MD5

      858a8298df3f289376bd4903c6f2ab7a

    • SHA1

      9467aa77a2d368ed7593305f3bd20ff984129595

    • SHA256

      ffc2c34d728009ffcdbce2fdb7a700516165f0ca449672174e9cebf78bb52bc9

    • SHA512

      4204ef3ea6917d68371c5ecdf5df0780b2b9a2b16262f94a0f60724b8ec97c9a33697a4a9793766013abb81a86ea348812291ec83f6ed2074aa5e054f8d25a77

    • SSDEEP

      98304:NMuUL5ne9zxKYgY7hy4d96G0e+hFhxgzTQpW11w65G1OR5B8J8gID1aNFO9Y:NMu2eNUYg0Eeqs/GMLN5B8JWBGFO9Y

    Score
    10/10
    asyncratstormkittyvenomratdiscoverypersistenceratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks