Extracted

• • Target
    Tax_Notice_36758.exe
  • Size 287KB
  • SHA256 93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
  • MD5 c9afda4f027fc9510134cffcc4d54da3
  • SHA1 c5b5fb5f06d1f6cf98afa0df97f57e9bd7b454ed
  • SHA512 91fc95c20e93059a470c5d6506ce368581679cb7b43216b44a5a1f2e440eee1729523935943226ad488a98cfc7ac7ce5888bae01ed359962feb3eb01e9b8e458
  • SSDEEP 6144:/bMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmU:/71Nfhu+1mqTnNFmU
  • TLSH
    T15A547D81FB866EFAEC79447C8AF1662AFB70B0180364C35B26989097DF133915D3A3D5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryasyncratvenomratpersistenceratrootkitstealer

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    nvml.dll
  • Size 328KB
  • SHA256 4f26feada7d5a765a3e8d1975b76499fb603bf9b0e7968a7fd855d9e01ae6770
  • MD5 cb75b13da73fdddb04a5ded7c33f07a5
  • SHA1 690c810f54d5fb489df570b1e21c0f9b2e2b9e13
  • SHA512 8e720b57cf415fc8635cc6083cd84ff61da10743858091ed10abc4a3415fd1dac78b54423ea96006d58abcc873db03fff368798fdf3c9599cf2426f194e55422
  • SSDEEP 6144:oDD7CapuS+EKnkC22KVuaHysiZl2jnS3MLejAMOkllVtLy32ujDIm:oCwZ0kxRaDCVqkM7Vt2N3
  • TLSH
    T142647C50F681FEB5EC8A8FB524E21349D3B6B041971DB92F6A60FE3C025EE68D073645
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4