Extracted

• • Target
    OrionBootstrapper.exe
  • Size 52KB
  • SHA256 33df83d0123e2eaccd9a8883eee0568dbd4927f0d7e9b347f152e05aa75006ec
  • MD5 bb1b4bd56ccbd4a453f5758537756acd
  • SHA1 497bf18ee594e2fc3b07e182baaeeb0cbd860c92
  • SHA512 8a8e4fa21d3941c50e3d0ca56cdafa5a183b2927f27891d1e433cb699c30ff96bcd57fae6927755ba5c7aa27dab5dbce52d317614c1d9a0a14b1dca5b6bc9ecf
  • SSDEEP 1536:CusL1TUfMso2A4f9wEJljN9bgcauOdmXF0dPj:Cus5TUfMso2A47JljN9bgbUF0pj
  • TLSH
    T138333B006BE9C126F27D4F7498F27259457AAAB33603E64E2CC431DB5E33BC15642AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceransomwarerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2