Extracted

• • Target
    bb4406ba13f55c3a625293095a491ef292394b6cd8a9a6831ff6b7b249466b6f.bin
  • Size 312KB
  • SHA256 bb4406ba13f55c3a625293095a491ef292394b6cd8a9a6831ff6b7b249466b6f
  • MD5 375d4796fba5137290e57566f3792a6c
  • SHA1 9439408953f7595f8591f1afb6cd166621088f73
  • SHA512 7621a2ecbe53235850f0a8e489322114924432a3333f78295941a946a342ac07ce0ee0443a7c829726730d53c51a5487736168b9e078897e15c0df9b0121505d
  • SSDEEP 6144:mB/1jGHH7IdqCPHwaymxUG83Z1fEmQ4mT1SD:e/1i7IdqCv9wZRpbmTI
  • TLSH
    T1C16412056ECC4BE8FFEE97F62059031A622F9C0409121BDD694E59B9FFC12FA05B7825
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcollectiondiscoveryexecutionasyncratpersistenceprivilege_escalationratspywarestealer

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2