Extracted

• • Target
    file_1782105621258.zip
  • Size 3.2MB
  • SHA256 25f4be8f08dca47da1a2defaa85ba6493dc311aaba99d5083349afeafc20136e
  • MD5 e77230a7d8318184799b70804440194f
  • SHA1 c227a1f2b14227b8740d90dfbf7b4b138cd0a3b4
  • SHA512 07d9f31b52943ba66cd2fa51f1785e3b792a5cd35f51dcf073d2e111f993ee4f3d528811fa5321b5a80fec244ee836189b90ecc15571a6c39ec2ffe1c153f5c5
  • SSDEEP 98304:aI4tVkfBlOXVaPqFYQc9MQ5PdawnNPalx:aojOAqOt9MCVlYx
  • TLSH
    T184F5335BFAC365FF06768DBE43C49229B31970B0002613BDDE639997F9259B2E338254
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Check.exe
  • Size 969KB
  • SHA256 5d695d8a0bb1d919cc77a2aa2488a61797bfa065238160278ee458120630aaf9
  • MD5 f9538485432d3ec640f89096ba2d4d00
  • SHA1 b050b847b1fe8be78d56b29bd23c25e05c227a92
  • SHA512 ea7aeedd15f4d6a6005f8cfb7d404dfb0c302c837e48de7e3ff44d7d5908f8de6c0a81f736d874a491eddc89fdf753976be6f635e7e8512f5abb7f32caa8cfc5
  • SSDEEP 24576:oFZAiQHDhht8m7FpUi1L1OXJz5zzz3zzzozzz3zzzNz:CZAiQHlhtz7FpWdwz
  • TLSH
    T168252A1BE7A345EDC56FC13487A3D772AA30B86942247E2E1E95D7222F20D50DF2E724
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultexecutionasyncratcoffloaderloaderpersistencerat

  • Async RAT payload

    rat

  • Detects Coffloader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Coffloader

    Coffloader is an open-source beacon loader written in C.

    loadercoffloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral2
• • Target
    libvlc.dll
  • Size 5.1MB
  • SHA256 d412eb32ac0d871737e677572d2fc728892426456a561d3508ae23bff08730f2
  • MD5 7ab992b131e4ebcc3996a7e40e9bff9f
  • SHA1 eda83a8d94778045f24e57caadf65ef407cc4b17
  • SHA512 2fd81b62cc2b105879838025097b03c5df8ec498b4deb27140903a183a094c0bf6465d8d1d872a3909d2b8c0b90a16b32b4e1fc0088fe322209a60a4abca5bbc
  • SSDEEP 49152:faRYX3I57TkL8fN1EM1gucRWMd6gaznfrcUk+5nXpN1O2Xj5bQJTiXly1DUGIDzE:gjoWDbXNjOR3asGXK
  • TLSH
    T18A3619EC2017D9CAC2BC4DE455184BC2C8C88E5E99A85A3875CF285C96FFB8D7494FB1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultexecutionasyncratcoffloaderloaderpersistencerat

  • Async RAT payload

    rat

  • Detects Coffloader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Coffloader

    Coffloader is an open-source beacon loader written in C.

    loadercoffloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral3