Extracted

• • Target

    Zexo.exe

  • Size

    63KB

  • MD5

    fe21311e262630af1a54520f55ca8c69

  • SHA1

    1d595196ae495436868b9b6d5f0d17d04a5ff8ef

  • SHA256

    62ab616a986ed8d7725c5c37122c385b7ad30b9e02d659e950fa099c9b8d9ed3

  • SHA512

    c89d654df3ab13762f1cf529d5526da7716bc61c6634d3255a0f01a4708a2701513cd45c0079f95d089df127f73386a83b0a19b1a09b5b2b28d0cb43946ce97f

  • SSDEEP

    768:jnuguX1wbgyX78dIC8A+XkuazcBRL5JTk1+T4KSBGHmDbD/ph0oXpdM7nNqSuEdP:rvCCPTDdSJYUbdh9jMXuEdpqKmY7

  Score

  10^/10

  asyncratstealeriumdefaultcollectiondiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2