Extracted

Extracted

• • Target
    lmagn-ArgentaPetera/lmagn-ArgentaPetera.js
  • Size 706KB
  • SHA256 c48e797eb50d9ffab72132cbef7bcac82b9cf7ee9a82ec78140d9f5d4435f9a7
  • MD5 663a8cf87a5a00b926ef726bb037a0d8
  • SHA1 696c8ec0537d7f4106b5e5439ab5fd99d7a78f2a
  • SHA512 f3d76888de621a1cb42730a177abcb65867450dec140ee3b846662093f681396886c2120b406672a651fb778a4937dd69fec572e2e5bef33fa30ce31088acd87
  • SSDEEP 3072:/s+xymWSNBJbs03Lm+xymWSNBJbs03LmpSc0WCQ7mwXXKPP00V9lVtpSc0WCIEir:/AKLbkKLbHWx7mwX800VOW2vmx
  • TLSH
    T194F40D89E7E71054E11321398FAFA2147535E50F5C0BD538B66CAAD05FC9A3806BEFE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  luxorrrrrrrrrrrrrrrdiscoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    lmagn-ArgentaPetera/lmagn-ArgentaPetera.pdf
  • Size 895KB
  • SHA256 a486625c04eaec02fd3404763e563af9d00f3b3c48ecf596e0a3b48019f2ca52
  • MD5 866d8015bb33dda8e71e783864eb6441
  • SHA1 d9fc80457b65c4f8a1b51bd17c7860560ebcd7a6
  • SHA512 e4050a95bcc274a07546fa94c15ccf5d997a68827362e0f0e5cc8d870240adc26466de0b686e7cb10111d30322230e3272a37eadda0bfba41ca97601184e4af2
  • SSDEEP 24576:4xd7S0vd2yBt0p+ddA1Adf9C0d25XJ0Kgc:wdDvAyD0qbd2RV
  • TLSH
    T13C1533DB00EDDF25A303BF54857569B61C10E43EACA30EC497AD543A56BE3C50AABE4C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4