Extracted

• • Target

    TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17.zip

  • Size

    483KB

  • MD5

    194c188093dcc132a8deea7b0dad1f2c

  • SHA1

    d52b99d85b91aa1fbdfe4afbb25d099539108380

  • SHA256

    83d1269b87125006ff08fd7d99a1e5b1fd62e9769848d9912853f4e56cb6ebff

  • SHA512

    dbb761c7e3210103ffd9aa1bf3c95eec5dcb47bcb8532635c3d4ebe5e0ca40e0f4e5e53cad880f5253b4009ef4bdc162be2c0545a95692beaef2840aa522c220

  • SSDEEP

    12288:FFT5Lc95Y6ynYHofdfppn4UJctToWkzGnp:FWPynYIfdxmU6cGp

  Score

  1^/10
  behavioral1behavioral2

• • Target

    Defender_Settings.vbs

  • Size

    313B

  • MD5

    b0bf0a477bcca312021177572311e666

  • SHA1

    ea77332d7779938ae8e92ad35d6dea4f4be37a92

  • SHA256

    af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9

  • SHA512

    09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8

  Score

  3^/10
  behavioral3behavioral4

• • Target

    ReadMe.txt

  • Size

    1KB

  • MD5

    f1f83d1a7091b8f45fa6eb8c23e693f0

  • SHA1

    9b76af0e3b67bcb5a4f314d3730cfbd4f0e309e9

  • SHA256

    9543c783866839729f10de8d51e629ad98c379c5e9e5dbc45cb4f72729c6b281

  • SHA512

    157023d6f72bd4ad883eae53a26bb89193b4294dfc77a3145ab386eff5a0161cbdfe2f970fd5c41d5667fa7195f3ffa89a6ec7e22479dbe49189e232ba647168

  Score

  1^/10
  behavioral5behavioral6

• • Target

    VantaFN.exe

  • Size

    3.8MB

  • MD5

    84699018b1132b73d8063290faa07789

  • SHA1

    7d1eec5ae60f0a0383f723f1e001dfc6c2c76aac

  • SHA256

    d35c91227f48c494930749f5486054244686328ad8e02960a6b0b10226bc174c

  • SHA512

    d7d29eaeacb5d4289aa0a3bbdf071f2e875bf307e326829432cfbbcff1b19e3eaccfc81ec5ebcbf2beab7dee8aff05ad8c086ac0e61a0837339f4febabef5ade

  • SSDEEP

    1536:ftTXAtyLaVfblJpAGUbVh9CU5uodpqKmY7:fWyaVPaGUbVjzGz

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral7behavioral8

• • Target

    dControl.exe

  • Size

    447KB

  • MD5

    58008524a6473bdf86c1040a9a9e39c3

  • SHA1

    cb704d2e8df80fd3500a5b817966dc262d80ddb8

  • SHA256

    1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

  • SHA512

    8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31

  • SSDEEP

    6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD

  Score

  7^/10

  upx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral10behavioral9

• • Target

    out.upx

  • Size

    653KB

  • MD5

    6970ea0b6597dcd5b4f5f19f28e958a8

  • SHA1

    a0130bb7ac03ec4799c90781ca93fd1392c6d54c

  • SHA256

    481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553

  • SHA512

    bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01

  • SSDEEP

    12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx

  Score

  1^/10
  behavioral11behavioral12

• • Target

    dControl.ini

  • Size

    85KB

  • MD5

    05450ff06366ae22654b63a6e27d1624

  • SHA1

    11453c370f41287fb6339e509bb9d3c91842b379

  • SHA256

    8e9a84da243905685ca77b6ef71841e610b88b7963d4de59f6dcbdd1621ecacd

  • SHA512

    ee0a9605b566aa89c8c9b260e1d9c15aecbd6cddc2df47fe24ef2cafbe8923b3e025bd5cd3d34499292589a3c094dd796ab4560c8099bad2051a54928c37b4b2

  • SSDEEP

    768:i/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSr6:1+NyjsxkKdkJdULgbWSO

  Score

  1^/10
  behavioral13behavioral14