Extracted

• • Target
    Client.exe
  • Size 74KB
  • SHA256 1ad5375a1d1c584e0c3002efaa14ed6e5f432fe7e7c76702c68cf40bf61fb8fe
  • MD5 971a75b45076325e40c04c904e7ad026
  • SHA1 164466e37da11d7260f35bb4ed1cbc480a0fba37
  • SHA512 bf822bddd2db340967fffc5796c2921d3a848edd3636c6cc30e5cce7624a3ca13614ccca1295d785a3ec2d39477b208a2c19ead62587e5807bbe8e5c7565d5bf
  • SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/gMTCQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bf3TCQPBY
  • TLSH
    T15B735A013BD88D2AF2AE47B9ACF256074EF4D1576112CE5E3CC440CD5A67BC68A037EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryasyncratpersistenceratstormkittystealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2