Extracted

• • Target

    Infected.exe

  • Size

    63KB

  • MD5

    f42f55956743758432a268841e68bbd6

  • SHA1

    f623961c98ae744960c9fc997fa6fd772a17d6e2

  • SHA256

    1946c5429eff2cec7b13cf088dedbfabb40f4231bb9016e028eb9e876483a3ee

  • SHA512

    e5f6624f16d3185b89ccf25c69f0b330d596c868b5e2bc2248a84bae787cdc015982acabb7c415ec7479314513a8d05cdb3fb4b0b4bdc19146589c70fd2ebe2f

  • SSDEEP

    768:VFVsjkUAON78iHC8A+XuqazcBRL5JTk1+T4KSBGHmDbD/ph0oXG9lOHruSuDdpqM:VwAOJ9dSJYUbdh9G45uDdpqKmY7

  Score

  10^/10

  asyncratdefaultratstealeriumcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationransomwarespywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Renames multiple (3658) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2