Extracted

• • Target

    F-M-E_v2/F-M-Е_v2.exe

  • Size

    1.2MB

  • MD5

    9e1ea15e3c048ed96c22a8e50bf83b8b

  • SHA1

    071a3420cf14fcb1ff96e33daa64f60ee92ac1e6

  • SHA256

    699050ce6a9803d066b0d5206dc946c1c54ae8ebc6e9bc7fa18836e9dc8ce46e

  • SHA512

    2c397b0f2d677e7d63ca607a72f85c5368dfbf8bb2036eec4ce53e597e8598972700ccd267de0696b40d0da5a99579ac3e7db5873c146b10cd22e75d0cc70afd

  • SSDEEP

    24576:acVkKSRXajM/0IV5diCURXnWvxxMiGh5Sq7Ttz8J:acBYXa+0kYCkn4giGhZvtz8J

  Score

  7^/10

  discoveryphishing

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2

• • Target

    F-M-E_v2/crack.exe

  • Size

    3.6MB

  • MD5

    b7882c8eeb5328a78cc3ea7b6b389695

  • SHA1

    174ad6cf4a52901e23f4346b9866ab88fcf9ec7a

  • SHA256

    52278c5c508198f8628a8c32687e63d5420e4940d2845aa963804dbee45ae737

  • SHA512

    170a6142fa81b45b20d234e91b63c4cbe5b5155126f921a7c8839ed01bc1ee0e0fe116fc3515fb7909b3cf77a22bac3830acf2cd12c02249f8814509e8f82da5

  • SSDEEP

    98304:QkqXf0FlL9nrYAWAZi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13U:QkSIlLtzWAXAkuujCPX9YG9he5GnQCAB

  Score

  10^/10

  asyncratdefaultcollectiondiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4