Extracted

• • Target
    toto.zip
  • Size 42.8MB
  • SHA256 f864ce25cc2ad1f888d62e0bb40c6567b9c8f89c5d96e82135335a9caa956593
  • MD5 b0c6737d9b1f9ffd3114f79712c6be96
  • SHA1 dd74f7195b62d2343315a75fbeb999c2e94d2028
  • SHA512 ea3f7f25a8c4c51fa8d356913a068bda08099e565458595745dcf0aedd4c6e8288be7608010064032a6cbb6a1cff3e9c28f1d660ac5a158c5ef7deaf6f4b8e1e
  • SSDEEP 786432:CDXXuerfHkIZf06hLwbl9Pm2TW38ZF+oxwk4fbSep827/SWt:CDnXfHkIZcXM2TdZooxwnXTSQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratstealeriumdefaultcollectiondiscoverypersistenceprivilege_escalationratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1