Extracted

• • Target
    f7b4d4e1a283ffaf1fd988e8658e796c36201b33c6d5dcfa37da98ed4fffe7ed
  • Size 2.8MB
  • SHA256 f7b4d4e1a283ffaf1fd988e8658e796c36201b33c6d5dcfa37da98ed4fffe7ed
  • MD5 f98a81eef1f8992748136d206f0e1a5e
  • SHA1 4d9705dea52bc848ee73e58234c8bba2e8712896
  • SHA512 843c3132e9d63588dd6f9b583ff56d3ba24d6105067dd2bbf014c6d9034ea50cf78caa089da542f454e5de439132a0644a19aa0d6dc72e1f9997d9f421533553
  • SSDEEP 49152:iYFc2X+xCl1zWFKDldtI5vFtWLWUKFYZlevjAmu+0/osl10:iYFc2X+xCl1zWFKDlrI5vFeqslevjAN7
  • TLSH
    T1C8D55BA6E94572CBD48F22788927DD42696D07FA4B110CC3A8EDB4BDBF63CC111B9C25
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratstormkittypersistenceprivilege_escalationratspywarestealer

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2