Extracted

Extracted

• • Target

    6d01213c51ed2570b263b28fa4b9f320.exe

  • Size

    1.1MB

  • MD5

    6d01213c51ed2570b263b28fa4b9f320

  • SHA1

    aa5aa4142ff6de7e5560424d252c2bf234f14651

  • SHA256

    b99d5d0e6ebfd38c47b999a704cb2558797ed6b149356075036a0de57fbca261

  • SHA512

    0ca8354473740c4f6212159f98571eaf3041ea895a3e067b52c9b5e380c948cc5df0fa18171674c35afd5f0bdeb75e676b41a548be1a3e05ed5f7906a8365766

  Score

  10^/10

  asyncratazorultmodiloaderdiscoveryevasioninfostealerpersistenceratspywaretrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Async RAT payload

    rat

  • ModiLoader First Stage

  • ModiLoader Second Stage

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • JavaScript code in executable

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2