Extracted

Extracted

• • Target

    LastActivityView.exe

  • Size

    69KB

  • MD5

    0f9957e07c58ab3e2870c0e8bf7d872a

  • SHA1

    1a1d98204c0ed2ac1a693ae4fac0127ffbd61425

  • SHA256

    5b4b7ee3ed81ea6e75c4ee134cce259605ac1afa38229ca6f34e8d5329f33dd6

  • SHA512

    8ca2f8229637c875f5520cfa526508ab055f2d46588e722cf68895e7a208fc90571e38ee29095a9f07b39965f3c9436264f582b22e8ae11bc5bc07bbbada8225

  • SSDEEP

    1536:YcKvgnZY4E/YYUbth9Dru9YhDWakpqKmY7:9tnZY4EQYUbtsavz

  Score

  10^/10

  asyncratumbraldefaultevasionexecutionratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Umbral payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1