Extracted

Extracted

• • Target

    a32eeb768e9e3963b250e4fedc495c0aa442022e2fe7a0f84b89d7812e687e16.exe

  • Size

    589KB

  • MD5

    28a7627d5eb7367ce48656c15dd98188

  • SHA1

    bf74de6c78c4f1b6977af3ec0abe4c49afbf16ee

  • SHA256

    a32eeb768e9e3963b250e4fedc495c0aa442022e2fe7a0f84b89d7812e687e16

  • SHA512

    46bdc7043c3d1821e1f71cf87fcb93fae3cefbe392a060c72c6ac33df2dc353f705fb79e47e20de6e4c7b4684b549d4ef20e83ffd758be8730d176f031c7f3f3

  • SSDEEP

    12288:qAH5qwTvYqtp4VFZgdHgo2anVmndXlMDc3cUAmNOeY632lTSh3soF:qAXxtqmdAxanIdXOS5NOLM

  Score

  10^/10

  asyncratredlinedefaultdiamotrixdiscoveryexecutioninfostealerpersistencepyinstallerratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2