Extracted

• • Target

    Project Buu.rar

  • Size

    30KB

  • MD5

    92873d2f99e985d47885123508f96de8

  • SHA1

    622e60c7bc942e6a003a7131c35cfe6ccff6d683

  • SHA256

    558909412427b05911a02cddfe00fc5e9d30bc38e1ba636d04aa7efb63438ec8

  • SHA512

    81f0f373c89af6599c511c4e5b5446353bf6b71ce34bb1e6c13d4b3c842e889b505484689c4e800c05dadbf20c54b6d9d5653bf41ae58b6b380b354b1e278dfe

  • SSDEEP

    768:JbQLvR3dqVDOkV406ur3n2N/MCiII7F+2H4:JbQLBnd0xL2vIQb

  Score

  10^/10

  asyncratdefaultevasionrattrojanstealeriumcollectiondiscoverypersistenceprivilege_escalationspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • UAC bypass

    evasiontrojan

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2

• • Target

    Project Buu/Dependencies/Dependencies.exe

  • Size

    63KB

  • MD5

    97be07e4d8fa640d71aa049385d8bcc2

  • SHA1

    cd21b0a98183abe177ce6b1a857f9b4166100b4d

  • SHA256

    df4e19980ecdf58f0a6562bad1e4929e30e21f4b3633f9f33ad4b86a5406ee31

  • SHA512

    23e6b9ea22b2dead07d5b6baf076afcf747e8ba02df9afbc81ca3011f91035cf6d385c5a9dd5ae63fe6f95010ab928379baf4d55cbb04c4bbdcf246689e52cd4

  • SSDEEP

    768:b2yVjLFj7778BIC8A+XkaazcBRL5JTk1+T4KSBGHmDbD/ph0oX2f2/F5qVKGVxSD:jJ7TPdSJYUbdh9GMMKGOuodpqKmY7

  Score

  10^/10

  asyncratdefaultratstealeriumcollectiondiscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • UAC bypass

    evasiontrojan

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral3behavioral4

• • Target

    Project Buu/Project Buu.py

  • Size

    8KB

  • MD5

    462eb1972b1711ce306e84c6b287141c

  • SHA1

    d6f0ca3723a23e474e659c46a5a8a237dbc0af38

  • SHA256

    afb4eebadb9704280e1088a8c815787c983f77e95e8998f4c0cd1bb5db05d053

  • SHA512

    c341137d941bd59eb9b17a0d0bd198cd0cfa42bdaaf9d8a8a494b708131834df877bcfdb2c82dc1c29a741ae603976b93dd9b03d3ffb0c679367d639a96a489a

  • SSDEEP

    96:r0xZ/z+1/CaBA+wFrmOdI/t2zYMczdoS6QS0UDZDUmEwID/Anr5weOkKixpiWWjb:/BSnW1JdBOJhPE//AOeOHiTu8Bv4

  Score

  3^/10
  behavioral5behavioral6

• • Target

    Project Buu/READ.txt

  • Size

    64B

  • MD5

    b185b3b82df61c6c8393ab1c5f48452b

  • SHA1

    7a38d650ee36c7ec1d327bfcfbe274399f18ae1f

  • SHA256

    bef6670cac1a35f22749634e9a63fd31b4eb3435b6eb9611cb2ef80f4b798268

  • SHA512

    af82134874be7df3a8e5e64d8d3f31ccdec09f097f234a96ef01632f6de49008b34bb7c10be80a748b40062e17b7777465803da837b6ccca1c85ee2d67fc5be8

  Score

  3^/10

  discovery
  behavioral7behavioral8