asyncrat | 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e

General

Target
01052026_1546_Tax-Number52563.img.zip
Size 4.6MB
Sample260723-fd1vasdr5t
SHA256 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e
MD5 892c4fe5f33f77b850c8419f450d1745
SHA1 490e76dfbe99a5931cbd3baae5756d6e1e89c69a
SHA512 3b301da7ddd0d24f35a3bdb09d2af8df7a5b9a2de27d0e4853c895bb566f86edcaf2d5dc033ceea0c15924cb7e62ea8d8561c29845284ba31fb7c880d5a14ebb
SSDEEP 98304:1Ve/Sb1DHcZv7bNNFEtBnHNS5thUOwwbZXdHJ04EJZ:nUSeR7bnCnn85thBJbh0LL
TLSH
T1D926233AFB783180F55C6DB0BB04998453EFAEDA469CCF5062447F198CFA69096CD836
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Tax-Number52563.img
- Size 324.4MB
- SHA256 646689ca806b1bd2d02ee23daf12a4ab174953f017306bc032423b8b59aabd4b
- MD5 496e489322721eb1106301ac71e2b8db
- SHA1 0dff48ad199ccefb2a082cd92a7d8c8786290b19
- SHA512 25962e7cef00737aacb117b81eca0790ab89d5185a376b724150b6a5403f6c22a80d285d439f92db3bfa7ee3841bbca032b528d2b5610885e089ffc23be0d483
- SSDEEP 786432:vTgVDqF7/BdDTGO3ZSWtTEsxWmmM8H66X70:vsRqh/fDTDQ/mmMK66
- TLSH
  T1A8F88E8673C4BADAC745DD3A6714F3314D939D338EBA90C6A997170A85B99730F38AC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  BugSplat64.dll
- Size 323.5MB
- SHA256 8e6b931599f2b6a6b3de024e6dcd42992fbf4aad7ec9838d91a1b49fdb57788f
- MD5 b0ef12c82220537385cd2e6a846af14f
- SHA1 abfa362b04be036d77142a0498926f4e2ccf38a5
- SHA512 4c34b057585867fe8d399d9f408ca66cd222ce9656668174702993a6f05ab026d43b0343f52fc8a137fd59aec5f29d176da353c7169bf1703e47dd7a5f178b01
- SSDEEP 786432:mTgVDqF7/BdDTGO3ZSWtTEsxWmmM8H66X706:msRqh/fDTDQ/mmMK66j
- TLSH
  T121F89C9673C4BADA8745DD1B6704F3314D9399338EBB90C6AD97170A86B99730F38AC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Tax-Number52563.exe
- Size 324KB
- SHA256 1ffc8bde92758bc0d2ddcc5a6bb78c73b6409429e52d62191f25afa8ebfad84a
- MD5 60138b3f2791742dd65bdf29376055e8
- SHA1 f6ade6bbdd1828add500aa82505567cf9f21efaf
- SHA512 5f331c57b6fbbdd8ab819cddfab1a9859da07b59de849ba34b556598b9d9647938bc7d8fc82bf3e7e35521be355bb316d80665b4cf75b9f71800d50b574055e2
- SSDEEP 3072:RxOb8VXWstpmWU/ya8UGEPzxP8EpwHUlHcTCuyuO/sOX52G99X6yoY46lhMAQG1Z:RxjtWGEPNP8Epw0lmEn0OplohRCyxzy
- TLSH
  T18A643946735408E8F76783398811D585E6727C390AB0E62FD3647A366E332939D3BB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery asyncrat stormkitty persistence rat stealer
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral5 behavioral6