Extracted

• • Target
    Rechnung_RE-56607332.lnk
  • Size 1KB
  • SHA256 0551383b325a5f517ffd12505230ce1b6583c3ca6c76a7c4a0b0eebcb6047d4a
  • MD5 8d4024195a82e217e9780cd1cd4653f1
  • SHA1 9ea6e4a063f4d360c3c6f196e03341dd700ba389
  • SHA512 e514aa5a8f033b9e6a9f59d292998e8fd1c70605a94783648bfd905b3a6f021e52317da5d9a9cf14cce3eff21018056b337e419cbed71e1a2b4ee29b058650ab
  • TLSH
    T1484178186BE84714E7F38B3A28E9931184767C52F966CF5C018091CC7824700F4B1F3B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defaultcollectioncosturadiscoverydropperexecutionasyncratstealeriumpackerpersistenceprivilege_escalationratspywarestealer

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Download via BitsAdmin

    dropper

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2