Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    Inquiry.html

  • Size

    312KB

  • MD5

    d9be2b4df752bce538b17bb70d28c38d

  • SHA1

    d11e735cce93726af9b17b7d524569dda0386e03

  • SHA256

    52aa4dc388981844c67bcf7b6135d3706f275bf9f20bd88facf9e35c904e0cd3

  • SHA512

    8ee8fef44ef372821cb3c8d7b229d833dbd8d7c289c4d8fb6547bdae69c7b14f2f038369238944d22c44b9fe87fd5ec208884d212aca6cb5e41c620029bcf363

  • SSDEEP

    6:aO+3Q21JOAZBvbLAqtybbTJOAZBvbLPMERVbjMRJViktbJFC1DqbGAL4vFC8unAU:FF21pDgqunpDvBjMxikJu0XGztu0Xn

  Score

  10^/10

  discoveryasyncratxwormdefaultvenom clientscredential_accessexecutionratstealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2