Extracted

Extracted

Extracted

• • Target

    Downloads.exe

  • Size

    1.6MB

  • MD5

    1e356cc44d9fafcd633b2e372a46ad53

  • SHA1

    0d0a32521cad4cb38dc3c841a486ed21a5454943

  • SHA256

    a729ddb411ab2f5a818be693d12b245215e5eb6ea79fad2fa87d85ea3e2cf683

  • SHA512

    91fa09c5be7543cbd4356370b2059521dc7ae2a47462f5871427a1ad5448249c9bf1e384c58c0966227a85574c913c09b9cff62f5bcae36ada9e8695b94e47cd

  • SSDEEP

    24576:jngHKYfXTkXy0Z0UplCOlyyXEwlKhgoCY9X8jOlC3rocE/0sED5cHD:zgqKIXzryOMoBlKRCgvA5M

  Score

  10^/10

  asyncratquasarumbraldefaultoffice04discoveryratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Umbral payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1