Extracted

• • Target
    Tax_Notice.exe
  • Size 118KB
  • SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
  • MD5 1605971fa40b7f784311cecea47a251e
  • SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
  • SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
  • SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
  • TLSH
    T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratvenomratpersistenceratrootkitstealertrojan

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Windows security bypass

    defense_evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    nvdaHelperRemote.dll
  • Size 150KB
  • SHA256 e71d16f594c033b235c916cd4653898916f82f10731e2f500605833ce2918cc9
  • MD5 800c69d81aa21fb2c421d54671427254
  • SHA1 f4fce5f38d1d1fe5acbd2f4722be52e0e69f69b8
  • SHA512 4cc3816ed3ae779e6084d44c4159dbb793482d98271d2f070280436e5139fde0f9ed493ebf63fc37faf0b07c5e7db9c1da25ef9fbec3ea07eeb2220621f54a45
  • SSDEEP 3072:S/vOXyjDH/GK7sFrgQKqF83OT9kN9Zfi/jVgJj+bdtGM5sg4:2vOkDfGK0rgC83Omf85K+KMt4
  • TLSH
    T1AEE3F1FD7AAD1F16CB24863195624E039EB43C1A0F879D6F0E22462D0B13645D736B3B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4