Extracted

• • Target
    4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486.exe
  • Size 175KB
  • SHA256 4902c56dfa5b513df7c00f8fe5df90dcc46a03f194dca424ebbf6f03e7904486
  • MD5 c7235b3be7873e0743aba6235cd3d677
  • SHA1 2481321813caff4ded19135c86301f899fb19f66
  • SHA512 7310beb111ca489fd6348d40cea921d8854d99858cb2b9dc7d8211009a8c958374832f585f2cb25962e7ed3a453ca11102b7fb47be0eff8d2a7bc2b564928860
  • SSDEEP 3072:r+ljDT+LbaRzegOBIIj6HLLYLCYJqvc1Dvu0gRsBaV/m4IauJX9bSM2dE+rBiQ+t:UDubaBBOBIIj6HLLYLCYJqvc1D2NsBMy
  • TLSH
    T1CA044A1037D80929E3FF5BB4F4B002168B31F9279A17E7AF1A9555EE0D32354E921BA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratstormkittypersistenceprivilege_escalationratspywarestealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2