Extracted

• • Target
    Dialysepatienter.exe
  • Size 218KB
  • SHA256 26fc8807ce9a5e6dc534c237d84c2ac7491755532a2078878bc8fb1695fcb2eb
  • MD5 44ddc80c714f91959bcaa1aeb3cfe1d5
  • SHA1 7a5ce656b36a081d0f93d5add93a9c8ddc329abf
  • SHA512 33d7d52c606db4f42e9d67a67e1ac248b123c71be6c55ac97f5dbaf755e0b969b8edf619c8a4b7afcd9a951c3b8e580c93f4a90380467cad48300d8186ab6f1e
  • SSDEEP 6144:LT4DtAX5NIc71RWI89tgqNw2Tn1LJ3kcMGuzIz39zl:LT35/z89lJCGl31l
  • TLSH
    T1FB2412A07769D453E7C382730875A77A2FF9A1BA66249F076F023E0CBD92782550F312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoverydownloaderasyncratguloaderpersistenceratspywarestealersuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • TLSH
    T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4