Overview

overview

10

Static

static

10

2026-09-29...er.exe

windows10-2004-x64

10

2026-09-29...er.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver
  • Size 5.8MB
  • Sample260930-gr5wvasfrc
  • SHA256 47b973dbadf02d2200588ee79fc33cd85ca2af4de5f3714d53cfd8c1e3acac73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratstormkittydefense_evasiondiscoveryexecutionpersistenceratstealertrojan

Malware Config

Targets

    • Target
      2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver
    • Size 5.8MB
    • SHA256 47b973dbadf02d2200588ee79fc33cd85ca2af4de5f3714d53cfd8c1e3acac73
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionasyncratstormkittypersistenceratstealertrojan

    • Async RAT payload

      rat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Family: StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Windows security bypass

      defense_evasiontrojan

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables attemping to enumerate video devices using WMI

    • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Detects executables referencing Discord tokens regular expressions

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing credit card regular expressions

    • Detects executables referencing many IR and analysis tools

    • Detects executables referencing many VPN software clients. Observed in infosteslers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

    • Detects executables referencing many email and collaboration clients. Observed in information steale

    • Detects executables with interest in wireless interface using netsh

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes a file named after a Windows system binary

      The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

      defense_evasion

    • Executes dropped EXE

    • Windows security modification

      defense_evasiontrojan

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks