Extracted

• • Target

    sigma nigger.exe

  • Size

    63KB

  • MD5

    02b879d944c0f3d15543e830e6570912

  • SHA1

    a5e4c91860c4242149204c0e39e11dc489304538

  • SHA256

    d45b4bffe48643060f1f5dd26e4d5e1a65ddf037082e6f6d7388e79ac29ad191

  • SHA512

    68f65d5c2e33fc08dd985c477d61c471eb9e784cc45e715703c9c05606d62250026f37e391a60a6e6be3f347e85da4042f28fddab714ccc48ba7e022c6538e28

  • SSDEEP

    768:fv0M2UM/978aQC8A+XjME+blFrW3E1+T4ZSBGHmDbDgphtoXsSkGwCYSukdpqKYC:k1/k4RrqEqYUb2h0xtTukdpqKmY7

  Score

  10^/10

  asyncratstealeriumdefaultcollectioncredential_accessdiscoverypersistenceprivilege_escalationransomwareratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Renames multiple (3492) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1