Extracted

• • Target
    Tax_Notice.exe
  • Size 118KB
  • SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
  • MD5 1605971fa40b7f784311cecea47a251e
  • SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
  • SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
  • SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
  • TLSH
    T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratvenomratpersistenceratrootkitstealertrojan

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Windows security bypass

    defense_evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    nvdaHelperRemote.dll
  • Size 147KB
  • SHA256 1dfe9be049f6bcad3caa8504dae4aad5e7e66d6e5ed8388478c7adb3de8d791a
  • MD5 a7b3e94a5fcd20c960c42426b7c9a0c9
  • SHA1 096b1f15b8884bc396a5daaef50a90b4c5bb4fcd
  • SHA512 4c1c26923626259f5754b4c89f10f982c307e2ef5aa720f599bdfa53310d28f863503e8ea43ad7bc13e176f4d8ae881f2d8ecedcd8cda7505ff82df7b99143a6
  • SSDEEP 3072:O/v8N/AXowG3B8OXFUlOW4jN9ZsWomRaPTPjbdtGM5sNgz:av8uowGbW4hhoOCjKM5
  • TLSH
    T1E4E301FC7AFA0DA7CB31A331E8228E07666538279787ED7F1531562603534828B3476B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4