Extracted

• • Target

    a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282

  • Size

    63KB

  • MD5

    b8d455465260a845db35492fda5a8888

  • SHA1

    287b0ba049ad8f3be802d2224efb86dba72d3221

  • SHA256

    a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282

  • SHA512

    5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a

  • SSDEEP

    768:CuY6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9rAW6dEYSuEdP:reQPckdSJYUbdh9O8uEdpqKmY7

  Score

  10^/10

  asyncratstealeriumdefaultcollectionevasionratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • UAC bypass

    evasiontrojan

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2