Extracted

• • Target

    sdcheck/SeedsChecker.exe

  • Size

    10.5MB

  • MD5

    5f7e0d25b165b9afcc3e6ca2bb135a47

  • SHA1

    72cbc2583a2dd5078a0edb83b153f38fb5ddb085

  • SHA256

    b94bb64c9f1e39f900c095b2034d3302a2a1cfeca08096ac71ecd24b5a25c61d

  • SHA512

    fd87ba28b3cd39b7938eba27d95588cacb51dd3e46c5f79282f3a2693e78387c1032b58b1186eae052a4d33680863c609588888dff46a3fb2542860eda4329fc

  • SSDEEP

    196608:BVE0qzgg7MlG6g4kpQbjHqsQLTJeriQAu8VAbC7EzpIjtoTSam0nuYaf:BV5qz7J6gKbjq1d4iFuE+CQzpI2+l0nu

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2

• • Target

    sdcheck/module.exe

  • Size

    40.1MB

  • MD5

    926853fdfffb1a4645f22bb5b7e10d71

  • SHA1

    8cfddabdd2d38175a51cd228b0a25ea0cec6f043

  • SHA256

    bde124a6ff61b44ca4313c5860535cb2b49693e602eee6746b3af7dec5623c17

  • SHA512

    64cbc3f1dc1a1c6f36df0277c1d96da2f5d3c1265149e425f9d6063015d78e96c4b604aeb6e6734a01140ec5bf4d925d1c4c2130f43f1f9e5ab432583c4630e8

  • SSDEEP

    786432:yFNHjOvEt1KXZfKXZhu14yyGifQARGMbExzZAZktBbNgx:yFNDQEaiq184A8YE5yYy

  Score

  7^/10

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral3behavioral4