Extracted

• • Target

    0lXGBz7ZMe.exe

  • Size

    74KB

  • MD5

    484c9d7582a74eb6fac05b9c7e4eac44

  • SHA1

    de1bce03ce38f32866ee0f545c1a7d94748ee7cf

  • SHA256

    fb0569e9a61a133ef7382181966c3bd3e21bc32d078804edbe1eea80cde43af4

  • SHA512

    90aaf9c27267ab318ac7d7e845678c6bf742ebadf7d785d0a03cdb9fd3abd0fbb866a5672ee0da4ffd04345192e2f49d24e0d8ab502a31ba790929f9a00dee22

  • SSDEEP

    1536:9UpGcx5NVCQkPMV+O9VdQuDI6H1bf/BMO5QyQzcBLVclN:9Uscx5zTkPMV+O9VdQsH1bficQyQYBY

  Score

  10^/10

  asyncratvenomratdefaultdiscoveryratstormkittydefense_evasionevasionexecutionspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    defense_evasiontrojan

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2