Extracted

• • Target
    Infected.exe
  • Size 63KB
  • SHA256 e16b11b08428ea53c18f7124234178dd5d05dda1d9cf067cc2fd4bcda7b41c25
  • MD5 b37de31d5573da05ce01ebf5f95ccc0c
  • SHA1 d357069f2518471451e8b84c84425cb3c6a5425a
  • SHA512 f7973f87344db57d8b76da2c6e3443982c3027390f6f8f71da1ed4173848ea1e07324646564e2f7db517ee3ca24762ab8d84f181cc2a6bd8e4a21ed44175b4a0
  • SSDEEP 768:r5TYuH50678GnC8A+X+GazcBRL5JTk1+T4KSBGHmDbD/ph0oXpmAQSufdpqKYhY7:h/00RdSJYUbdh93XufdpqKmY7
  • TLSH
    T17F536C013798C965E1AE87B8BCF2560106B1C6772112DA1E3CC810DB6BAFFC656527FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcollectioncosturadefense_evasiondiscoveryevasionexecutionasyncratstealeriumstormkittypackerpersistenceprivilege_escalationransomwareratspywarestealertrojan

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • StormKitty payload

  • Renames multiple (1457) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2