Extracted

• • Target

    7ec73c3cdb2ab4d8ead126d75d8e75e6.exe

  • Size

    415KB

  • MD5

    7ec73c3cdb2ab4d8ead126d75d8e75e6

  • SHA1

    72932cec27122ff030c4e9300026be77c91da7f3

  • SHA256

    662373470e1e29fdc50870c0296a21446f2231455ae93dfb9f4339e21d8eaca5

  • SHA512

    46a6c5b05bf93d1746ddc9c58f5040832b1c81240580c49831b1c068952eaa2c8111484b7d72c1d51e7688b78a1416f27b8463fb46c3887886d1b2ade0f36f14

  • SSDEEP

    12288:7DbFgXY5JxdtIeCP5BRQhgRHf0e9c/j0xMZ2t+4GspUx:3FdtIe+e+RHf0Hx

  Score

  10^/10

  asyncratdefaultpersistenceratspywarestealerthemida

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2