Extracted

Extracted

Extracted

• • Target

    c7dc6a8a03f4b02dd7bd2171adf105d40af49cd5a5d58d890aec160f3bc8ab3b

  • Size

    1.8MB

  • MD5

    eeb6ba8314046a14bcfb132f787bed16

  • SHA1

    a1061be651c6b4e43c0085d0ff7b45500f9e8ceb

  • SHA256

    c7dc6a8a03f4b02dd7bd2171adf105d40af49cd5a5d58d890aec160f3bc8ab3b

  • SHA512

    9808690a2c810f7875d8f8a2ce70c3c962967d565f2f476bff7e80ee0fd8a59be4520e72c3b85991cd1e581946a5cddecbf1af674d76f7e004e061fee3907758

  • SSDEEP

    49152:o0OB/3taBrb/TMvO90d7HjmAFd4A64nsfJ4OngXG/jpCcOhz1:c347Z

  Score

  10^/10

  asyncratbitratredlinexenarmorcheatnewcollectiondiscoveryinfostealerpasswordpersistenceratrecoveryspywarestealertrojanupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Async RAT payload

    rat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2