Extracted

Extracted

• • Target

    BootstrapperV2.09(rat).exe

  • Size

    5.9MB

  • MD5

    bbe4425a7b91d830ae36203ce3660a19

  • SHA1

    147d8f6cd4b7694a6274cde567b4b94c51bc3b3a

  • SHA256

    f65b4ac5a2e3791b5851ff09840e334a51169cee78a5c383f956cc11e912ece6

  • SHA512

    a4e1957b5a829bd6a833fca9616e790f6fc976c35bc6110f259142415593a0369e5dc6ec45e3dc72b1ea3776d7a999beb77b80d80c36684391412e8beb4425e9

  • SSDEEP

    98304:Voqb1QHJ2we9het0Un2reIgLxmqMBfiGJRkZqtVwCYWoOacfHM26PbF8qz16B8BB:VoMIJJeCwaxmZBfiGJRkZqtGCYTQMXF7

  Score

  10^/10

  asyncratgurcudefaultcollectiondiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1