Extracted

Extracted

Extracted

• • Target

    Swift_Message_Notification_MTC-U27635728_03-2025.exe

  • Size

    1.9MB

  • MD5

    d18a7c52ddb2548776af2ffecd92862f

  • SHA1

    eeac7cf04fa8da67dde3046fe4aa5edc4d6e49da

  • SHA256

    4d693b4dd287f3aba462951d56f00aac4432794d3b489dfa93ffd17dbf40edc3

  • SHA512

    db1155d3c373f8c4b93712b218e2500d7da835a557220261f605c90926e2674668415cbe2ff89621b94771a7a9adc71bdbb86d44aba34a7576e734e0c982b2a1

  • SSDEEP

    49152:TR0c++OCvkGs9FaktzIuPkpYeDmg27RnWGj:1B3vkJ9HIuPYzD527BWG

  Score

  10^/10

  asyncratredlinevenomratxwormdefaultsuccessdiscoveryexecutioninfostealerpersistenceratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2