Extracted

Extracted

• • Target

    Downloads.exe

  • Size

    11.1MB

  • MD5

    03443b92e798c949af90c1afc59be60b

  • SHA1

    a860455aa51306f6563ec1091db8bbebb1afc672

  • SHA256

    da88e9a029e6335e992a131cd0e4cc60c28a3cdad23d628d54db770ee694ace5

  • SHA512

    eaf0ff832c28c06d413e6200538f4f3d264c919850eee72a9f9cccd3480a07aeff0ae8bc2d00af8ab66924707e7aca8cf0c237ca2e157478271ef5d68d9764b3

  • SSDEEP

    196608:zzXuVy7rxVoq0Rw3b/kiZOjI5oiYwrFdF8jr1N6NforhRiVtl7X/LDouPs1sjPPZ:eopVofYjxFYwrFdFK1N8fo2VL7vLDQqZ

  Score

  10^/10

  asyncratquasarumbralxmrigdefaultoffice04discoveryminerratspywarestealertrojanupxexecution

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Umbral payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2