Extracted

• • Target

    toto.zip

  • Size

    42.8MB

  • MD5

    b0c6737d9b1f9ffd3114f79712c6be96

  • SHA1

    dd74f7195b62d2343315a75fbeb999c2e94d2028

  • SHA256

    f864ce25cc2ad1f888d62e0bb40c6567b9c8f89c5d96e82135335a9caa956593

  • SHA512

    ea3f7f25a8c4c51fa8d356913a068bda08099e565458595745dcf0aedd4c6e8288be7608010064032a6cbb6a1cff3e9c28f1d660ac5a158c5ef7deaf6f4b8e1e

  • SSDEEP

    786432:CDXXuerfHkIZf06hLwbl9Pm2TW38ZF+oxwk4fbSep827/SWt:CDnXfHkIZcXM2TdZooxwnXTSQ

  Score

  10^/10

  asyncratstealeriumdefaultcollectiondiscoverypersistenceprivilege_escalationratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1