Extracted

• • Target

    d51be99781d3e1a89f9b632e748e2bd2fc1a1c554f8c1d9ac0db0a9e19af4c81

  • Size

    234KB

  • MD5

    4d54f37b7b9cb8f4e9a7ba334e711889

  • SHA1

    d83e92210f74883074da45db0e50210ee0531fad

  • SHA256

    d51be99781d3e1a89f9b632e748e2bd2fc1a1c554f8c1d9ac0db0a9e19af4c81

  • SHA512

    effbb2b5c2bd3db1da9acbb8e8b298f69cd5de86fc2906c88c17e922290a0f7b9554075fbcd35a47b8a678ef573f097cc5656ac073823b9a1b387bc795c778d5

  • SSDEEP

    3072:A+STW8djpN6izj8mZwpuAtiIR6iYj7PcUbBuVByshwp//DrB36eKzF0y6+WpRt:18XN6W8mmpmX0UbUeshIXDIzF4

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2