Extracted

Extracted

Extracted

• • Target

    tost.bat

  • Size

    23KB

  • MD5

    c26f41f48d02002dec3ad4e5156bfdda

  • SHA1

    03abcb03be3d39da5e513f4f7056df179047eb2c

  • SHA256

    5153a4d8ee131d9edb35829e1326f08c19d718c572a9274eacb7430896ec5112

  • SHA512

    ed079f1e71aeaa49593c4dbdb3a916bc86daf5e0f2071772854e50d3e2d9690bc4957e4c65c09498bfa76aaa103aa99ab76fb893f2118e757ed8ecb4d1a3b3ba

  • SSDEEP

    384:gTYcpQyuPmhDGEhtKCiFl8sutSjJ7RWGFX8qQt4TdKtyCHIbRJGE2fl08bcOB3wO:gTYcpQyuPmhDGEhtKC1snbWGWdIKZHIQ

  Score

  10^/10

  discoveryexecutionasyncratstealeriumxwormdefaultcollectionpersistenceprivilege_escalationratstealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2