Extracted

• • Target

    RFQ_PO_783B65/RFQ-PO783B65.bat

  • Size

    45B

  • MD5

    c15f0bc7c754ae5cc5f09d4a646232a5

  • SHA1

    3463cfed84c507ea4839793db9a19b79d9218632

  • SHA256

    1d25f7af62786393a933913bcbd4e0412b7261817ecea3aeb60e2294adaece9d

  • SHA512

    bf5c3da788c3807d8be313765f12671cc67bac797214d7a18ab1570c6fbcbb4a8536ec169633329d51d22b087692ebfed45fd8565277a4c26df656ab6e9e43f0

  Score

  10^/10

  asyncratvenomratdefaultcollectiondiscoverypersistenceprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    RFQ_PO_783B65/RFQ-PO783B65.png

  • Size

    1.1MB

  • MD5

    c655f74a0a364d39ca8c4c7f46647a15

  • SHA1

    04fa23d7ff51f5b503c991f7d9ff0d4c919b89b0

  • SHA256

    6ff96de44e65161cfb8afd5e46e30b4940be0187b0c5422ff270f4e5adfb60a7

  • SHA512

    120b10adc8b83feeaf26663f954ecba4e06dd6a3100f1d0405e5c054f62441ea9ad92015a296e9d56f9a295b11dbb54e5bcfddd26958a0dcc1633126c2f9a09e

  • SSDEEP

    24576:mKyowlc5WdDtWmW6/2t1tm5JcL8FPujl3mV0UKAaL:93wlcctTf2t1tm56LG4LFAa

  Score

  10^/10

  asyncratvenomratdefaultcollectiondiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4