Extracted

Extracted

• • Target

    Found-Crypto-V2.0.exe

  • Size

    19.2MB

  • MD5

    ee975199f978b3a8ba28f45267b67c7d

  • SHA1

    20c11128838a84f714fe861fabb4efed7760556b

  • SHA256

    ba4426aa503f405add2a842436447a472a77dd0a977d2edc9bd92e39f795e738

  • SHA512

    c83cbc39344399f47feb022675bc8a0b63a45b2549c1ae6c2944ccba9f122a9bdaba331a9100b8f4512ec1a943609b2233a10315380c5ca4e7c5dc4aaa035b13

  • SSDEEP

    393216:BdGdkkwbW+eGQRcMTozGxu8C0ibflYau5qW80hoA/aUPcHSpJbxs1EX6WkDW5:BdGyVW+e5RloztZ0b5qW80hVWCbiJLDy

  Score

  10^/10

  asyncratredlinedefaultdiamotrixdiscoveryexecutioninfostealerpersistencepyinstallerratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Suspicious use of SetThreadContext

  behavioral1