asyncrat | 9669269b9b9870d1603f89520b3e1aa01645bb705dae1c7a6871ffe8742e1432

General

Target
3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip
Size 4.2MB
Sample260730-lj1dlsfa87
SHA256 9669269b9b9870d1603f89520b3e1aa01645bb705dae1c7a6871ffe8742e1432
MD5 b51ddb5cb40be8c4a2ee18bbe3cc139f
SHA1 f782be060f7c3f20ba3ad5bb6508a990d1f5ce17
SHA512 22578aed942e8ae4d3dc344c982ae67e456ee8a6def756629890d165030d59df8ad19d6f4fc77a3e8dbe5f5d5feb225919b5160794377c82b30b68e41b8f503a
SSDEEP 98304:yIUrKikLoMheOzP0ugHQ4nlanl5bjHXMOy2yg5S2/DKQlWC4pLnLyD:yIUr7kmN1Q2S533y2yK/DKQlWAD
TLSH
T12016333249AE85B0F3FB40BF6C8873100939A9B95BA3ACF9D0754E5E8131DADC5DA513
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BugSplat64.dll
- Size 323.5MB
- SHA256 8e6b931599f2b6a6b3de024e6dcd42992fbf4aad7ec9838d91a1b49fdb57788f
- MD5 b0ef12c82220537385cd2e6a846af14f
- SHA1 abfa362b04be036d77142a0498926f4e2ccf38a5
- SHA512 4c34b057585867fe8d399d9f408ca66cd222ce9656668174702993a6f05ab026d43b0343f52fc8a137fd59aec5f29d176da353c7169bf1703e47dd7a5f178b01
- SSDEEP 786432:mTgVDqF7/BdDTGO3ZSWtTEsxWmmM8H66X706:msRqh/fDTDQ/mmMK66j
- TLSH
  T121F89C9673C4BADA8745DD1B6704F3314D9399338EBB90C6AD97170A86B99730F38AC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Tax-Number52563.exe
- Size 324KB
- SHA256 1ffc8bde92758bc0d2ddcc5a6bb78c73b6409429e52d62191f25afa8ebfad84a
- MD5 60138b3f2791742dd65bdf29376055e8
- SHA1 f6ade6bbdd1828add500aa82505567cf9f21efaf
- SHA512 5f331c57b6fbbdd8ab819cddfab1a9859da07b59de849ba34b556598b9d9647938bc7d8fc82bf3e7e35521be355bb316d80665b4cf75b9f71800d50b574055e2
- SSDEEP 3072:RxOb8VXWstpmWU/ya8UGEPzxP8EpwHUlHcTCuyuO/sOX52G99X6yoY46lhMAQG1Z:RxjtWGEPNP8Epw0lmEn0OplohRCyxzy
- TLSH
  T18A643946735408E8F76783398811D585E6727C390AB0E62FD3647A366E332939D3BB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery asyncrat stormkitty persistence rat stealer
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral2