Extracted

• • Target
    SwissArmySuite.exe
  • Size 8.4MB
  • SHA256 bf73c67869db2375cc4e01202ad26edd9300eb00bf3fedd0f20c86848f32986c
  • MD5 f1eb8d59ee24b6e1dd3d7b7f155fed5f
  • SHA1 4bcf3d9be8758c72238ffaa468e55137af307afd
  • SHA512 f7425e87a7a852913b1b6d04aee7116b0954285d5921377e07394817cdf1cb36f745ace5ed4227802ea49e11f3c4b63fd34d7a50c675462e8e0d3c89c2eca0e2
  • SSDEEP 98304:W2UHLtt8dlKNOM9+0BRvEpSW821Zb0MvwR0mV93P9max5QOs:W2U197LW8gNwR0KtwaYN
  • TLSH
    T18F965B15BA9A59ADC49BC47483464B639A3170CB0B35BAFF45C481352F6ABF02F3D728
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratneshtastormkittypersistenceratspywarestealer

  • Async RAT payload

    rat

  • Detect Neshta payload

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2behavioral3behavioral4