Extracted

Extracted

• • Target
    Tetona_Cam Nalr/doc_2026.pdf
  • Size 550KB
  • SHA256 4a187d5dbaacb1610fcdbb3adb55c2ce8c351dfc4049ba6598904b5acfe8a2b0
  • MD5 c06afaa50226f5491ffa5089e030c2d1
  • SHA1 d8f1ff72bda782d74a5a03f8c31f2eab22d78ba3
  • SHA512 593b7f981edf1868ba923c7c86d0eacc14a59c0b46f93df3e6fc86766505186382bed3e488b42af75ca51c98ea47b75e2850867df0750c997937f7063bd3cc8d
  • SSDEEP 12288:nnBLkARUoPJtmplDBOvgwIBHfNE8J9IyBIooSnhsvpbGPLQ3GWfWf4YdlPs:nBLDUoPJOBOvpIB1Es9FBdDnhsvtFO4L
  • TLSH
    T16AC423BF4E33BEB3F73552A86115B58B1BC6CF2DD64FBC6C1940A933A016E02251669C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    Tetona_Cam Nalr/fots_privada.vbs
  • Size 27KB
  • SHA256 df8fdfa59be66457ac00c7f12c4e4ae14cce76023eedc8f540ad257f5a5ebb29
  • MD5 7a04bcc595a5e1d01cd4e4fe6d445a10
  • SHA1 a4d9bd7f3d84c19c4eabf832ce09d387827dbf69
  • SHA512 aad3bb631a1d7d9abd8e802c2ab74796a2b7d1dc9b248a2e518a81aeb2dbddb0be406986478b2999ecdcc282270a5880d6218903630f532abb71dc0b61119d87
  • SSDEEP 384:Hli5pLYeS0jrNi6BYhvY07Zys3SvAL002AOob20bvkBZ:Hli5pYe5jJi6BQvYfsCvALNOQjQ
  • TLSH
    T197C251126C035434A0234AB34C6B643ADB2100A3B7906AF53E5CF7E60F65B16BDBF969
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  tuku123discoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4