Extracted

Extracted

Extracted

Extracted

• • Target

    1riage Fiddler shit.zip

  • Size

    28.9MB

  • MD5

    7dec47dd246b6a81c9f0992091ef2d03

  • SHA1

    c46e9addf83d24adeb036b8ed33a6dd13c024ede

  • SHA256

    28327d9e90781c714d6951c767b3fa88396048b81178e9b691ab8edef0e59cf7

  • SHA512

    2b2469a6535a311d8e3cc4fb4b0aac852b3e5a15306d3f53c83255867e61314ba1adb0a1ae2089160b61a48634d388efafda6813c8020b94e2046a57e68a2de6

  • SSDEEP

    786432:CBzytd5XjMdi0R6fu29sdi0R6fu2z+2UqeESHo4t/Isp:YzyRQRd2mRd2fMf

  Score

  10^/10

  discoveryevasionpersistenceprivilege_escalationasyncratgurculummaquasardefaultrobotcollectioncredential_accessexecutionmotwphishingratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Async RAT payload

    rat

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • A potential corporate email address has been identified in the URL: =@L

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Suspicious use of SetThreadContext

  behavioral1behavioral2