Extracted

• • Target
    65a0f2d03690ac43dfb2c3a758d4e021b1832478f443a8be03e8538a38c05352.ps1
  • Size 13.0MB
  • SHA256 65a0f2d03690ac43dfb2c3a758d4e021b1832478f443a8be03e8538a38c05352
  • MD5 3fe2fb1e371d879f826b53ff9f2e21ce
  • SHA1 d7646c760d45b8df26a4d2fee4cfb5dde21d861d
  • SHA512 c84dcfd551d3e4ba0e5c57a79e4074ef0dbed709e53f34e0ea02c38fcf92de9f150f11363a84c74127c5f13b43e65a5478b5ae05a582a6e2347b87593d61a468
  • SSDEEP 49152:Z4Whi6ikPpLUuqA96t73Qn0KxCmUlPCflJztD:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratstealeriumdefaultcollectionratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables manipulated with Fody

  • Detects executables referencing Discord tokens regular expressions

  • Detects executables referencing credit card regular expressions

  • Detects executables referencing many VPN software clients. Observed in infosteslers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with interest in wireless interface using netsh

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2