Extracted

• • Target
    Tax_Notice.exe
  • Size 118KB
  • SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
  • MD5 1605971fa40b7f784311cecea47a251e
  • SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
  • SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
  • SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
  • TLSH
    T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratpersistenceratadwareransomwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    nvdaHelperRemote.dll
  • Size 141KB
  • SHA256 df8e020418f40d1a21a65f827c364e4d90610ba08914abb37b31b5531caf95eb
  • MD5 8eb210aeb7f6f9eff85fd1eff78986b5
  • SHA1 712ee99f1038a1e0c7f64299c73882b9a6ae0b76
  • SHA512 d22d3405e2ea4a09d15415d4ec5e7ca5f5a708e51cb4ef09efc6875dfd396c2a2bbfc4206d184e2bb19d1a65d6be64fc421091a6ee932ed104d3727cd54f6de2
  • SSDEEP 3072:I1Bvf76aiiN8+ZuhHJ5QASGMphmMH0oOl1Z:I196aiiX42KMDUlZ
  • TLSH
    T198E302598A2464C3E13F49B70DFA65A936FAB3720F1E7C49050D73AD9C24C0F7D26968
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4