Extracted

• • Target

    E-STATMENT99923.exe

  • Size

    11.1MB

  • MD5

    114710ee73b8143f2e0242b660bcac15

  • SHA1

    e3866c2da48a3f7f0ba93225756ce7f723654725

  • SHA256

    f7ae58f22cbdeb69318f6cb3ff3757a9888e8731febd66e85ee9938f874705c9

  • SHA512

    a67cc555d2c51eec384834c2de0219cb9b98199b19603a159b181549fc3881cb84eba83891d6ffbdef9b95837d091868ec7ac9a66be14c52dad28deb1760134d

  • SSDEEP

    196608:LLHMUaWqpuqdk5m5erJrZvsq7xRtPOONA8HSc3kdMUf4DqwT/:LAUTqbS5mwrJlUEtWN8HDUdM3p

  Score

  10^/10

  discoverypyinstallerasyncrat8/4/2004rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Drops startup file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/NAct.dll

  • Size

    206KB

  • MD5

    4680d6b7998bfbe553d71f2dbef292f5

  • SHA1

    8afe71650680570e799d95ca926bca5610300c6f

  • SHA256

    f23b8d65606c71b8dcecd34078d6037730a16979d402ea5e99a8df1447553c47

  • SHA512

    067bb52f7be4c29c650578bd617fdeb56b555f6e3331c046305dbc706645b3aded0448a457d0045ce2dd8c4d9eaac213d88f39f7acad7c07255568c5e240617b

  • SSDEEP

    3072:YfZnhZnKQ8GhYLpx6psBoac5/pvla1QQC2mCOSvWOOCaQOPBjJ7YQueuVvCjost:GJhZ/8GhYupsBfc5/LaY4WpxQOUKUs

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    bf712f32249029466fa86756f5546950

  • SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

  • SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

  • SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

  • SSDEEP

    192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    $PLUGINSDIR/UAC.dll

  • Size

    14KB

  • MD5

    adb29e6b186daa765dc750128649b63d

  • SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

  • SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

  • SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

  • SSDEEP

    192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

  Score

  3^/10

  discovery
  behavioral7behavioral8

• • Target

    $PLUGINSDIR/UserInfo.dll

  • Size

    4KB

  • MD5

    c7ce0e47c83525983fd2c4c9566b4aad

  • SHA1

    38b7ad7bb32ffae35540fce373b8a671878dc54e

  • SHA256

    6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

  • SHA512

    ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

  Score

  3^/10

  discovery
  behavioral10behavioral9

• • Target

    $PLUGINSDIR/nsDialogs.dll

  • Size

    9KB

  • MD5

    4ccc4a742d4423f2f0ed744fd9c81f63

  • SHA1

    704f00a1acc327fd879cf75fc90d0b8f927c36bc

  • SHA256

    416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

  • SHA512

    790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

  • SSDEEP

    192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi

  Score

  3^/10

  discovery
  behavioral11behavioral12

• • Target

    $TEMP/@New_x32OD/@New_x32OD.exe

  • Size

    12.4MB

  • MD5

    eb82a685cf9348bff8cd0a5bb710518a

  • SHA1

    1e179c8dbb68f9a272e703f20e54f45d0f78ae6f

  • SHA256

    bbfc49b0c160e7d0231ad70f3e45c9e9e7a7935da863792fde2732a2ce594614

  • SHA512

    4dbecaa1b0fa0fa59e3e040942f0512207678cf4a4e182bd4657a576d70829b532e40b77bf6a719a156af10fb63ec97a193c5e0cc88043676c7889d148e14516

  • SSDEEP

    196608:sWzB9ZNJm3AqJ8Ef+r9onJ5hrZEK3e9tGPqK5N0wTbcKC9L3tm565:dzB9Z/m3p2E+r9c5hlEK/PN8w3cb59m

  Score

  10^/10

  asyncrat8/4/2004discoverypyinstallerrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral13behavioral14