General
- Target 899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0
- Size 3.5MB
- Sample260915-hdadfssgka
- SHA256 899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0
Score
10/10
Malware Config
Targets
-
- Target 899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0
- Size 3.5MB
- SHA256 899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0
Score10/10-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Family: StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.