Extracted

• • Target

    ve.py.decoded1.exe

  • Size

    344KB

  • MD5

    df30248a64d62d5d7f368a280ca3b30f

  • SHA1

    f7478cf4d97675956b98b577c473007b479df034

  • SHA256

    4583a1571f9b3b243e99e0f2bb56ba1492ae3371bce975af8ddede349a7be5bb

  • SHA512

    6f653b58f8852623a51f5a11f7fedaa9c22a275938ce9866b39b1d6e77add26b30bad937247b60af915365cfe3f4da3f9394623605e7217f517968d8d4b79485

  • SSDEEP

    6144:Mw16Niu3DOHDOCJTAL8QvjCdMH9O1BNI:M06Niu38DOqTAL8QvgMo7I

  Score

  10^/10

  asyncratstealeriumdefaultcollectiondiscoverypersistenceprivilege_escalationratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2