Extracted

• • Target

    OperaGXSetup (41).exe

  • Size

    3.8MB

  • MD5

    f6a94c99deff44303f682dd2bb7d3d12

  • SHA1

    f2c6fa65a69a67a3e2120cfbb61511a495c18688

  • SHA256

    28eb5915b45f87b4ff342dbfb0122757217e79277770e9fd06a6342009c56829

  • SHA512

    16edb4c4ef94a0e19088c69a3150fc2f0e158e707eb8a4a085d7e95eecde2fbdc4bdd1afbb3fc0b13d179d2a4e60f60de14a4224a998dfb6d944dea6441ec3ec

  • SSDEEP

    49152:ZVAbwA+j3AtriaXicL8D8nqdZqb8oM28CBHmLOIt/ZwDAakqbMz3Lnn7cAWFJJL:PA+jxJIfMKmLOIt/yDh7MbLnnXWFv

  Score

  10^/10

  asyncratdefaultdiscoveryphishingratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • A potential corporate email address has been identified in the URL: 6633dd5dcff475e6fb744426_&@2x.png

    phishing

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1