Extracted

• • Target

    README‮txt.SCR

  • Size

    3.6MB

  • MD5

    67fa781a0df1aea8159a22c0390023f3

  • SHA1

    d3641ee05ddd0a652a9004894f09b484336f115e

  • SHA256

    c59878f34eb08565dde137d3da8f37185c07b01de149b4c210497703c737605a

  • SHA512

    2f7fb249fd1e4097928adffd40b5131002b6fb47a26248d92f0781f6510dbb4e382febd2bfc7755970baf2f4c90d48591ca3edc08d10ed0491df9ee4575eff2f

  • SSDEEP

    98304:AkqXf0FlL9nrYAWAZi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13U:AkSIlLtzWAXAkuujCPX9YG9he5GnQCAB

  Score

  10^/10

  asyncratdefaultsteamcollectiondiscoverypersistencephishingprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detected potential entity reuse from brand STEAM.

    phishingsteam
  behavioral1