Extracted

• • Target

    600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.mal_

  • Size

    331KB

  • MD5

    63b427f3875eaf7475491877a49f71c5

  • SHA1

    8d6a1d3ce30eec4284cc3303fdf12a22a12f2a82

  • SHA256

    600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1

  • SHA512

    c9ee7f62f028aafe4a2753e50c61a1ae25816d586f6eb080d6ff20be0f7d27f8b5b384ad473625042e76b2e708cf0407e52d8a6fda5c9f1ffc0caf40a4636a3c

  • SSDEEP

    6144:eEjIabdDyAnk2S5dE1hQqX9lecEEMH9O1BNI:eAIabd7nkc1h9X9Mo7I

  Score

  10^/10

  asyncratstealeriumdefaultcollectioncredential_accessdiscoverypersistenceprivilege_escalationratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2