Extracted

• • Target

    spoofer.exe

  • Size

    63KB

  • MD5

    7b83be6f1191a46dffbcb8b247032ff1

  • SHA1

    aa8d7a06023c02b0da56a7709da6166a4aa29e27

  • SHA256

    aa78748b86f0ff09a010cf75093b1174f3e26e140b350150282f503cdb446b4d

  • SHA512

    a5616b85d65cf396cd4c0dbbb88adbae6929e662d0121fd15449fafcdc606bfb666638772869b5787072f74c631734169a46a2d9ec151e410ab185b702cb563a

  • SSDEEP

    1536:yEXign23dVdu3kYUbZhPnqTEq2nuuKpqKmY7:yZO23dyUYUbZNqPqZz

  Score

  10^/10

  asyncratdefaultcredential_accessdiscoveryransomwareratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Renames multiple (3090) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1