Extracted

• • Target

    Toolz (astro).zip

  • Size

    161.1MB

  • MD5

    103e93f9408f4195f294dc1aea765604

  • SHA1

    6e25051cb67851af85c1df5d1b91a90321e0957e

  • SHA256

    110fd83bdeee1785c51b4ae919ea9aabffe74dfd9014a42577bb5ede476ea58a

  • SHA512

    99dc616c28b3389bf4c5b49eaa5cb2f91eaeb0c9a22147a5da5bbe9e1dc061410f90ebc8e0064a4a070faba40448b551278cc578fa8dea638f9e45a27cbcdf56

  • SSDEEP

    3145728:sZparHZgZR/+0kZSi9vkbRNjX8GXKXaU5OgTbt+J7y+rL58Nj6m+ctQ+xhZJZSrl:6oGZp+0kut2OgTIJ7y+rL5oxaNb

  Score

  10^/10

  asyncratstealeriumstormkittydefaultdiscoveryratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1