Extracted

• • Target
    2026-08-06_5605437f572014dede8988ff66488464_amadey_asyncrat_cobalt-strike_elex_glassworm_icedid_infy_karagany_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar
  • Size 11.9MB
  • SHA256 45aa9a69958e5237c9cb3c9529b95964d0bdc16d82776197078ac73ef63e0dd3
  • MD5 5605437f572014dede8988ff66488464
  • SHA1 67a1d586a49222d61f6a35667ab3211c20320148
  • SHA512 64b6aedef1d74a68d4f8dd5e66b20678ebe90ac6e5f141886cd444da960a08430deabd476ee909e9e6dfd3fde22aff5b586c945dae587b0946c0038c669a29af
  • SSDEEP 196608:97FuoY0W8UA5My4urH/P/XRLO/uAqMVVbL72KKmO:NFuEW8Zr4uDXsWAq4tLA
  • TLSH
    T141C6230773822055D17793B8F0C3E7599F7A6E029602C5FB32E238944EBF6D486B2B56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratstormkittypersistenceprivilege_escalationpyinstallerratspywarestealer

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables referencing Discord tokens regular expressions

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing credit card regular expressions

  • Detects executables referencing many VPN software clients. Observed in infosteslers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables using Telegram Chat Bot

  • Detects executables with interest in wireless interface using netsh

  • Detects file containing reversed ASEP Autorun registry keys

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2