Extracted

• • Target
    x09374a17895bc5b543dcb5c0cf465b6932219df3362d64e8dd1e3299c0a3e196.exe
  • Size 1.3MB
  • SHA256 09374a17895bc5b543dcb5c0cf465b6932219df3362d64e8dd1e3299c0a3e196
  • MD5 1ea08fa34839d3a58802ce71c20fe6fb
  • SHA1 0c65321bbdabbfc35366678e3244b4c34c503ab4
  • SHA512 58ff2236368f7865bf6bc22e046fb55675bf153c46d2e2e4f8f53a1dc1a9fafe355817caf5c5ab36122689353f4565eed60dff1035c91a6ba39e0b63e47c4a1c
  • SSDEEP 24576:HgsdB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H/BLNiXicJFFRGNzj3
  • TLSH
    T12E55129362E530F4E1B68139C5624514E7A5BC3947219FEF83202A1E5F37BD68E39B32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionasyncratmilleniumratquasarstormkittyvenomratpersistenceransomwareratrootkitspywarestealertrojancredential_access

  • Async RAT payload

    rat

  • Detects MilleniumRAT stealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Quasar payload

  • StormKitty payload

  • VenomRAT

    Detects VenomRAT.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2