Extracted

• • Target
    Toolz (astro).zip
  • Size 161.1MB
  • SHA256 110fd83bdeee1785c51b4ae919ea9aabffe74dfd9014a42577bb5ede476ea58a
  • MD5 103e93f9408f4195f294dc1aea765604
  • SHA1 6e25051cb67851af85c1df5d1b91a90321e0957e
  • SHA512 99dc616c28b3389bf4c5b49eaa5cb2f91eaeb0c9a22147a5da5bbe9e1dc061410f90ebc8e0064a4a070faba40448b551278cc578fa8dea638f9e45a27cbcdf56
  • SSDEEP 3145728:sZparHZgZR/+0kZSi9vkbRNjX8GXKXaU5OgTbt+J7y+rL58Nj6m+ctQ+xhZJZSrl:6oGZp+0kut2OgTIJ7y+rL5oxaNb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratstealeriumstormkittydefaultdefense_evasiondiscoverymotwpersistencephishingprivilege_escalationratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1
• • Target
    888 Rat v1.2.6/888 Rat v1.2.6.exe
  • Size 75.0MB
  • SHA256 5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98
  • MD5 ad33064a9ca95c5b3ed45c14b7fe2739
  • SHA1 0bd1286fa5fd936a31a4514798daffa444ce8e12
  • SHA512 acb056e217edef4639179b24193a454f7e5aade51c1cc972e0458fc23c0ad982323161ad37050a4d849641dbf84719707efdcf4c99ecdf413381e5a752413647
  • SSDEEP 1572864:5mhnD+9mK/LnkHD1LYrXatfLllR3RboTmxXlIgU/cNruKPZiv:6nD+UozkJLYrXajR4ElIgU/c5Qv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoveryupx

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral2
• • Target
    Anarchy Panel.exe
  • Size 54.6MB
  • SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
  • MD5 94bac1a0cc0dbac256f0d3b4c90648c2
  • SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
  • SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
  • SSDEEP 786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Loads dropped DLL

  behavioral3