Extracted

• • Target
    Neos Email Spoofer 2025.exe
  • Size 13.1MB
  • SHA256 0c872a86596c724a4459f057f8bcf016b1d98c3fe82f55a0770e2beb5b2b72cb
  • MD5 6d139062ff1391ba1d42f531733bcf74
  • SHA1 f3bb9689bb4867c693ea65a70cf0dd3b081d9c43
  • SHA512 aae96eb618e02fc6d40e2932db46bbf3356df06eaadb38eead526a6a89f82fb0e32563391b2f7c67254d4236c034e85bd79433daa7643dd5ee598131fd4886dc
  • SSDEEP 196608:JEfqJmjRTOdj4ENerBrgqvMXnFZQ6yejWAtlHjbFeToVPH/KDJUxGEOeTOLnEakE:JyGrywe6qvoG+3DZeoS/eT4PJL5
  • TLSH
    T115D633C2B6C7C571D6F91231E551FB6ACD3C791A4169C44E83928A3BE938481933FEA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  clippercredential_accessdefense_evasiondiscoveryexecutionasyncratmilleniumratquasarshinobu_clipperstormkittypersistencepyarmorpyinstallerratspywarestealertrojan

  • Detects MilleniumRAT stealer

  • Detects ShinobuClipper payload

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: ShinobuClipper

    ShinobuClipper is a clipboard-hijacking malware that replaces copied cryptocurrency wallet addresses with attacker-controlled ones.

    clippershinobu_clipper

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • Quasar payload

  • StormKitty payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4