Extracted

• • Target

    autoinstall dll @powergirlso2.exe

  • Size

    2.0MB

  • MD5

    390e8cf06fa3eb9ebf46ca2498bbe0a7

  • SHA1

    cc2ce83fd17f26e8889c94263624b98cd46254d4

  • SHA256

    0ba3f53dc303731f8060b81fecfd87026b55052488853f4df228255eeba35a8d

  • SHA512

    821d13b2d099736bc9f410ad1138d3bf6c09e2ef0ae93259b937de1b0652eb968a4f097c26006a75f94548ee237989464f5620b86116dc9654fef7e49452d633

  • SSDEEP

    24576:xkBGRu7kCvNuLJHCUgGZJkQqRX7usVzRxaiKwr/8jh80trwEuepKunr:6BerzgpKW/8jh86UEke

  Score

  10^/10

  asyncratdefaultdiscoveryratstealeriumcollectionpersistenceprivilege_escalationstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2