Extracted

• • Target
    Xvldeos_Lexi_Belle_OnlyFans_222639/'
  • Size 489KB
  • SHA256 0c2d38e4390acf92b34f3de288d4ae1baefa933ffa3e75450dea87498b545ede
  • MD5 58a237e755e3e45016bcf0f99d1291d2
  • SHA1 c1da2ea7fa9255ba26977fa0be89a4c0fd531350
  • SHA512 1e1c511e33951b138313d9a7c5c0d664aef24a04de174549a63002d08ba2d526eee39e671943789d0439db7b7ae22374b0d59498d250a03472aa391b036df889
  • SSDEEP 12288:7MROxTfOnMmXGP6cYLNaA4Q8Lte5aCyy93DzUrA44Qk35:4IxinvXGP6cKrp8LE5a9g3DX
  • TLSH
    T1D6B423AD874E444EC843EC739DB8551B4E6B6E951AC4CAF329307781BB862973FD3290
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  1discoveryexecutionasyncratratspywarestealerupx

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    Xvldeos_Lexi_Belle_OnlyFans_222639/IMGSS_952148.vbs
  • Size 16.2MB
  • SHA256 13a101b5613c11d56ea370a2d74b973557eac0a4592f93cefaea0bcdff841b1f
  • MD5 129056270e894160e9916438138edc7c
  • SHA1 f40c1fe8fd8be42f4ece6efc732d7dfdd73b05b3
  • SHA512 850adc1f62527879c6402ce37e4e4fb62b76720f51452164f3294c501f9e10b67365858a14c67b12bdaf2627777fc40e100f03e44905acf8b1e7828b42cd7ebe
  • SSDEEP 768:s2PY6zvEXv8LSHtTrz3AN27i3nHsiWybTe+CQevLPgD/SV4YK3ZREnbzaAX3nWeu:dt
  • TLSH
    T1B507B4B58D89F88F5642EE4F0A9FFCD7A59D30C5ABCD0771644746B02320B029BB356A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  1discoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4