Extracted

• • Target

    Kleinschmidt GmbH Invoices - Payment Receipt..exe

  • Size

    796KB

  • MD5

    3d2af31c95b477dc90f42b825ad7c126

  • SHA1

    9064ca55686edead9351d49c911c184caa236ae7

  • SHA256

    1fec1e11e26b8d1de831b50ff0163dfca3a751e3bb28ea372b54a7c9cc19cff6

  • SHA512

    8da1a7c125eee396cbc7e5a386503ce60c6ef2f187e0d158ab7491e60b90913df452fce94190821c1b41c819963879869756f6cbfe35c44e60efe71dafe1805d

  • SSDEEP

    6144:Gk4I1/j6U/sWc918LevX14oT61JDC2ya7/yo5tNLCFC7z/7tkW/x2RDXY3/+75f0:0UuscX8LqFY1JD/moblCAz5V/qYPe

  Score

  10^/10

  asyncratdefaultratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2