Extracted

• • Target

    Ionic.Zip.Reduced.dll

  • Size

    247KB

  • MD5

    7c359500407dd393a276010ab778d5af

  • SHA1

    4d63d669b73acaca3fc62ec263589acaaea91c0b

  • SHA256

    a4009288982e4c30d22b544167f72db882e34f0fda7d4061b2c02c84688c0ed1

  • SHA512

    88a25138d0a491e5ee27499206e05b8c501da0c73ad2b3e23d70e810a09bfc1b701817de7f22c9f0b9f81f90235fe5eeadd112773035a11f01706eac364b34bc

  • SSDEEP

    3072:nrI52ReHNdAFnfPPShREuMPb9YlVVRxpop2i0KKCXrXSbS4KcMy8ZZL5QlcSCSLw:yNdA+Myl7TpNiWCL4EycZb4

  Score

  1^/10
  behavioral1behavioral2

• • Target

    [Leakcloud.fun] Link Skipper.exe

  • Size

    523.0MB

  • MD5

    b928c8e9fbdea0d3d904df7a09955640

  • SHA1

    3caec7a61590a0287d2c350da8439cf977f3ab7a

  • SHA256

    1f1407140a7a550335d170429646438cef0d37ec51a6378ac08c132e9e7d8420

  • SHA512

    7627815855b32eec15e358246f2764b517790afb7bdac6ada17ec3184c96397248f1ce1150d3efe54f779f0e290bb2d03b6124a6c6df2dd2c7cfadc0138a627a

  • SSDEEP

    49152:XJED040Mm05vldXLyY4huQNuZo+rGlYnqRK7xPNH6Yjs1hm0zydRtmSH07JS44iE:XCX5soNvqRK7dqSdzmy4JMdaP67

  Score

  10^/10

  asyncratlink skipper bdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4