Extracted

Extracted

• • Target

    crashed_by_vohr.mp3

  • Size

    9.3MB

  • MD5

    0d813790b342f04e991a7f07487d39c7

  • SHA1

    b3b73c636113390813ed338e83530120b5d0b9cd

  • SHA256

    ad15869dd2adda745da583f9c1038ffdb127d7a2bab682b82c9858fd64c32301

  • SHA512

    49b666e7dbed2903a544e04a2a1499537293fb09410d6391fd0f4b9d421880211930988e6aaaa5a99f2ccfd13cd8f7c6237270b34a7dd4fffe33bc13c252cc6c

  • SSDEEP

    196608:OHK+1paMFx7zrfwVsZ1ZfjqkKIdPhvy/dxP:5+14MFx7HfhXfxdTKHP

  Score

  10^/10

  asyncrattoxiceyedefagilenetpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Downloads MZ/PE file

  • Modifies Installed Components in the registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2