Extracted

• • Target

    Client.exe

  • Size

    63KB

  • MD5

    bf1e0b700f4955c1bf6ff3d5cd010658

  • SHA1

    6919b4a8c0443b02846717e0764e7052b34c00c2

  • SHA256

    ce44ab513606e6ba64fee7a9f5d5cd236b57dc856374578dca043d84e00d8541

  • SHA512

    c6168ee1ceb98c3eca66b6aa1f5503849dc94e357da016dd5a1a6697337a68fc57bc3d4cc83dbdb74b4ed2b959a0b1099c18e93470db53d339bfbe0858b20844

  • SSDEEP

    1536:ZhIBLTM3Ufc0cMdmeeiIVUGbbXwLDxmcGbzpqKmY7:ZhIBLTM3Ufc6d/egGbbX2iwz

  Score

  10^/10

  asyncratvenom clientscollectionratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2