Extracted

Extracted

Extracted

• • Target

    a24eecf198fa982b1b31f389f637f2b336d2a1691aa6547fb01c20d6a553f741

  • Size

    1.0MB

  • MD5

    e614eeb8f38c51e9b2121ea29a233b8c

  • SHA1

    f2d118dd05105f823aea82c0a7e1e11518ec8566

  • SHA256

    a24eecf198fa982b1b31f389f637f2b336d2a1691aa6547fb01c20d6a553f741

  • SHA512

    2d2c5fd9440a58840d05b00c7de636aa036c43a9b566dcec6ac63eaa05ee710e01bd616b27e5c6294fe9e71154a036950b088e4e50325da787e27ec30191a00c

  • SSDEEP

    24576:eyuEA+BxVR0Wv9q+Dt91dTty1Ttk33S1dE+MU9MuV2NIERZWroBnv:tukzVRZjtzdT4gC1dE+MHY22ERZWroBn

  Score

  10^/10

  asyncratredlinelusamundernewday2discoveryevasioninfostealerpersistenceratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1