Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe

  • Size

    7.8MB

  • MD5

    49849ea730c690df970bb542dbd18e95

  • SHA1

    24063f28fa7dee0e0c54236bac0ab6d9a5b1e31f

  • SHA256

    3f947f5a849f11be9079a5c2418240e2faf7e53b63662c85b92fad8f47ea4d09

  • SHA512

    58a27fa9600b41e25c7393b5c043c0a2f0ba19dff5db1e048e06f898a883ec8fc6e362e7847be8373b62d077577bd7285e791232c4336dcfb9fafc35cd179e69

  • SSDEEP

    196608:JWLqEnZMIImZP/6N+ylO9MOchY35XhF35oTGxUh:J4qIZRImpCoyI35XhFpE0Uh

  Score

  10^/10

  onlyloggerredlinesocelarsvidar915v3user1aspackv2infostealerloaderspywarestealerasyncratarrowrat clientsmedia19nrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Async RAT payload

    rat

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • OnlyLogger payload

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2