Extracted

• • Target

    a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266

  • Size

    53.5MB

  • MD5

    aefaebe48f578958c832f359d62406c1

  • SHA1

    da6313c09ddbc2bb7ec5e0acc8a0c9d49d5d0051

  • SHA256

    a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266

  • SHA512

    e1cc0b6b2a19c0c511ff22a777a1b8db8296bca2797be32e837cab7ee4763104968de84f0e89649bbc0ae79b0812e3970712a3ea50a7f1a5b98e254b49f4f5e5

  • SSDEEP

    1572864:pudEgIEMQXW+iffRUBPRD1peCaz5JuId9JWMr4bJz:phEMQX7iffRSR53W/l9JW2O1

  Score

  10^/10

  discoveryasyncratdefaultexecutionpersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/SpiderBanner.dll

  • Size

    9KB

  • MD5

    17309e33b596ba3a5693b4d3e85cf8d7

  • SHA1

    7d361836cf53df42021c7f2b148aec9458818c01

  • SHA256

    996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

  • SHA512

    1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

  • SSDEEP

    192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

  Score

  1^/10
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/StdUtils.dll

  • Size

    101KB

  • MD5

    33b4e69e7835e18b9437623367dd1787

  • SHA1

    53afa03edaf931abdc2d828e5a2c89ad573d926c

  • SHA256

    72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae

  • SHA512

    ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

  • SSDEEP

    1536:Ayy+wx2YAlWrU5OX9crt5c4DBqiC7hk333kbQk:ry+wojIwgNcr1a7WH0b

  Score

  3^/10
  behavioral5behavioral6

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    75ed96254fbf894e42058062b4b4f0d1

  • SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

  • SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

  • SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • SSDEEP

    192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

  Score

  3^/10
  behavioral7behavioral8

• • Target

    LICENSES.chromium.html

  • Size

    4.5MB

  • MD5

    d4a79b5d46f0931b9eb7125fd40baff0

  • SHA1

    3a38fb263dde2251b9fe157b5fddec7acb07c53e

  • SHA256

    03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f

  • SHA512

    17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339

  • SSDEEP

    24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV

  Score

  1^/10
  behavioral10behavioral9

• • Target

    d3dcompiler_47.dll

  • Size

    4.3MB

  • MD5

    7641e39b7da4077084d2afe7c31032e0

  • SHA1

    2256644f69435ff2fee76deb04d918083960d1eb

  • SHA256

    44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

  • SHA512

    8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

  • SSDEEP

    49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt

  Score

  1^/10
  behavioral11

• • Target

    ffmpeg.dll

  • Size

    2.7MB

  • MD5

    eabfc10d56cb44a86493cb2f8ca7aab2

  • SHA1

    09d7e87f43527333cd021329d6c2f4e8bd8ddab5

  • SHA256

    42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

  • SHA512

    ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

  • SSDEEP

    49152:YISWBURglcWlJUQSyPV3cZ8RxDZa+DmXfUStDw/JcImohiiMoFwEgy:YPnvdZoJpMoQ

  Score

  1^/10
  behavioral12behavioral13

• • Target

    genp.exe

  • Size

    120.4MB

  • MD5

    0d8d495fed8e72ed25596c167725b82e

  • SHA1

    808c2773be263ca72114836bc865ec33a67713c9

  • SHA256

    c0b7602807caee94da179e24d12ca299ec2adbcf3c875aeb0291eccefaacca16

  • SHA512

    41a01d383171394b9bdf21eb125893795b15b14432333949ea39d882928d62cc2f16609a4184f0b252b04ed7fc707b30b5a745ea478f1db675a1e2e7c9e044ab

  • SSDEEP

    1572864:y1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:Pasulbg8yTnbEOz

  Score

  10^/10

  asyncratdefaultexecutionpersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral14behavioral15

• • Target

    libEGL.dll

  • Size

    438KB

  • MD5

    660a9ae1282e6205fc0a51e64470eb5b

  • SHA1

    f91a9c9559f51a8f33a552f0145ed9e706909de8

  • SHA256

    f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85

  • SHA512

    20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

  • SSDEEP

    6144:79h+56bG/eyllh9g1Kajo9wEVzZJAWpf4IBL75+Hjr:79Jbwla1KoAwqf4I4v

  Score

  1^/10
  behavioral16behavioral17

• • Target

    libGLESv2.dll

  • Size

    7.3MB

  • MD5

    bc45db0195aa369cc3c572e4e9eefc7e

  • SHA1

    b880ca4933656be52f027028af5ef8a3b7e07e97

  • SHA256

    a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10

  • SHA512

    dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

  • SSDEEP

    98304:txhV5ahd7dNgHB1g468F4p9+7ULjSLy+W:tDVEhd7dcFE9+kSLx

  Score

  1^/10
  behavioral18behavioral19

• • Target

    resources/app.asar

  • Size

    191KB

  • MD5

    ce32140dc21905f9e2978b94822e3ddb

  • SHA1

    80f9d9b6470c23cd1fb1a6e9311ef586881c4e45

  • SHA256

    23c067c9f5c8382496cf4705e138d219a4e5fff2d7b656a71ad8deb7f51a9e6a

  • SHA512

    cacaa0f7704d3777a3da5dbde1911aee39fc80b257a27bb16c3b6d0d5b8dfd4958a31e75caa3c115bc4a6aaff68deb70700cbe5ed4b9de03e0a6236102267ebd

  • SSDEEP

    3072:1O65N88FdZxYj+EoRwupCjQbNg0s5Lyii+zvF4DbqCKabQjqxtt7WSf:wqU+EoO8e0o+BYvF4DbqCKab9xttKSf

  Score

  3^/10

  execution
  behavioral20behavioral21

• • Target

    resources/elevate.exe

  • Size

    105KB

  • MD5

    792b92c8ad13c46f27c7ced0810694df

  • SHA1

    d8d449b92de20a57df722df46435ba4553ecc802

  • SHA256

    9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

  • SHA512

    6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

  • SSDEEP

    3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

  Score

  1^/10
  behavioral22behavioral23

• • Target

    swiftshader/libEGL.dll

  • Size

    460KB

  • MD5

    acd46d81bb4f34912c255a8d01953635

  • SHA1

    25969cc9e588e174b854566778f283f067c3c0c6

  • SHA256

    bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189

  • SHA512

    83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

  • SSDEEP

    6144:9ljnvKkgWLOf4qw66is0YtuoCjUnPt5WpbOvcbufBnVjC4mz4sky:nnzgWLOQqD6iATYbObfYvky

  Score

  1^/10
  behavioral24behavioral25

• • Target

    swiftshader/libGLESv2.dll

  • Size

    3.1MB

  • MD5

    8090f82a02c6850cc7bd2b481a7533e0

  • SHA1

    54a0b66d76c1b60e45e83ba4627299d0b2aae84a

  • SHA256

    e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e

  • SHA512

    b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

  • SSDEEP

    49152:FFE2SqB1Ip0Ak1DWFZ1zyQF+sANuFQ+3ELK/QdYLBYXLkk9/kBOwfoUBYXD5vWqC:4QEZB/SK/QK5PXgw5O1

  Score

  1^/10
  behavioral26behavioral27

• • Target

    vk_swiftshader.dll

  • Size

    4.3MB

  • MD5

    df2f469b761a706fba0b50149660f7cf

  • SHA1

    2f9d8cb92b6e321e24a5437a1f77745a3507e7be

  • SHA256

    be1e1dd3897dc9a997fdc5b3216f9af24c20fc678963f7486b0a6dae8900c274

  • SHA512

    827e979f573f5cbbe6dd3c6bbe4414ab0d292005856b651b157f150a8d5605c3e77f76944dc0158ae9c632bdc31c243b1e9a467f03d3d3ddb08e95ff5b2e1347

  • SSDEEP

    49152:nR4+5d8q8C/l80az6722j5V7IqD0o/1aZ/MMN5xSvEftz4VbHX5C+cn4br4nhXsH:dDTvEF89HPoptTgY+XB

  Score

  1^/10
  behavioral28behavioral29

• • Target

    vulkan-1.dll

  • Size

    715KB

  • MD5

    67ebd2114a9c3a1b2ce2635f21e100e8

  • SHA1

    15a8315b28dca9d7b5c1f604882050714f130718

  • SHA256

    37ee8858cada6db0e511d083ba0729282b004b7e239966521300955ad8b1b18a

  • SHA512

    6578d098b657ba4b28da60f338e033f5622e2fa9473d1833af85a44b314c1d662fcf12120dc466c7c19fcd5901b012f1f8ae7c9ce65ff8155ecd68714f25e102

  • SSDEEP

    12288:QDSRRxZS8ZkDVQ0FQNNTlSdBHxEXdgzXosoIjspf:QDSZZSe2Q0FOTleadgLP2f

  Score

  1^/10
  behavioral30behavioral31

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    6KB

  • MD5

    3d366250fcf8b755fce575c75f8c79e4

  • SHA1

    2ebac7df78154738d41aac8e27d7a0e482845c57

  • SHA256

    8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

  • SHA512

    67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

  • SSDEEP

    96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP

  Score

  3^/10
  behavioral32