Extracted

• • Target
    Secur32.dll
  • Size 2.7MB
  • SHA256 2163da71e704029aaa775d16fb9450a663181872a33d9336d20c1f5df0da7b0e
  • MD5 a7b6dcc26daf3f2de18d56f9b7cdce88
  • SHA1 2dae7771965e577cb1390992c54683f0c092ea5a
  • SHA512 91f758324205658296d26fd26f979c0ef7953aab4d234939afca61b9f48f0828e0ec60603cf43459111af81769b709cc9c376e31e9875f4d8936fad8a808b911
  • SSDEEP 49152:8TnhCxmSjUGlzhvT1HgqjG4cMgBjvSUzyOOP07FhBK0xLLVa6:q279cMgBjvSUzyOOP07FhBK0xLLVa6
  • TLSH
    T130D5BF45B3C86AA9D456DE34D754F232C2B2B8238F7290CB0A96C71A2F77D914B3E741
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  notarydiscoveryasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Лист на ДНК та ПН (семінар на 27.08.26-28.08.26).exe
  • Size 3.9MB
  • SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
  • MD5 bf62f6760a9b86f66822fa59140aef8b
  • SHA1 a71dc7dff873a5341ee93a254fa43e61f85298de
  • SHA512 f47af18705dfd6beec15109c227ca614dd314ce7a5dc4c19b10fc5388d07cd5990e5ea09128235cd88b595eef91a7c0e63e091bf8fc9947479f3d5d8167d9d31
  • SSDEEP 49152:eYqEK9Q8jm5Uzq0LYxjvOPg+BgAiyg8xK90g/u8KwQ61PwST3:lwQD0LYxjvWa3mz8NB3
  • TLSH
    T1A1168C17F68903F9C09AC1749B579162F626BC2A2B3562DF364CB2141F7AEE04B7E311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  notarydiscoveryasyncratpersistenceprivilege_escalationratspywarestealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Drops file in Drivers directory

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral3