Extracted

• • Target

    GTA IV Crackeado.scr

  • Size

    92KB

  • MD5

    45fd5ec423b9249dadeb514183ab92ef

  • SHA1

    970d4eae78bc6c930af937293e30624837cb1be7

  • SHA256

    1fd9737a9a043e1286868cbd211bae4bf8d39e719232268624308da77e491b3e

  • SHA512

    30bc9dd43f30d50fd8301113b721cf147f5e5e4c3466cefb26aa36ed0529dccdb9473adac5bdfcba33fde4d6b8a762fec3fd67c64dfc858c13af96f588930941

  • SSDEEP

    1536:jvsBtJyPA+ITEtnnA0GX416ZW2I51wr7bepjyDAF80xVY5pp:jvsrYHI6npCQeWFLq6BCg80Ux

  Score

  10^/10

  asyncratxoristcloud1discoverypersistenceransomwareratspywarestealerupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detected Xorist Ransomware

  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist

  • Xorist family

    xorist

  • Async RAT payload

    rat

  • Renames multiple (2200) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3