Extracted

• • Target

    hy.ps1

  • Size

    9.0MB

  • MD5

    c867dbeca2907417d58f0bfb4de699d6

  • SHA1

    fa942ea34e59c938d9c307a9c5054118b21fa699

  • SHA256

    19317da5733e40de48774b836f81b6edd83a60976ef180b6e796928399cee1c3

  • SHA512

    2658decfca16f085932c43ee6397cb449ab7ecf041d2c46630a5fdb3075c21eb9e5836ddb2e9018f4aac99f68ba9a1c3e19973da5c9ca58fc9bb2f7278b557e5

  • SSDEEP

    24576:sEAjJLSsZ05S8PllqWR4Q4/YVwCxCpMt8JNim5irz5aRt5vQZUZMc7JS0Ccn3ban:W8RVkwoFZ0qQpynBV

  Score

  10^/10

  asyncratstealeriumdefaultcollectionratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2