Extracted

Extracted

• • Target
    lIMGS-chaturbateArgPetera/lIMGS-chaturbateArgPetera.js
  • Size 426KB
  • SHA256 b40b3021261e3f3e6c313e5f8a15ab9e1d903b456caed275f7da2231611d51e0
  • MD5 0c9e2e038e502aa134115e7046089ec2
  • SHA1 0e6713bfba30a6d0a150e6dba26d503b222a62dd
  • SHA512 ff4677946d0e0264736f2392b211d3f6b062770f6c20ead19895bca3da6280fd5144180a95b72aa745ad243af4dca0745c50488d80c073d9c5cda7375abbbbaf
  • SSDEEP 3072:mWSNBJbs03Lm+xymWSNBJbs03LmpSc0WCeapcSvmsILRlVtpSc0WCIEiapcSvms2:KLbkKLbHW4vm6W2vmx
  • TLSH
    T1B79430597BEB2114E513313A4FAF6148B57A940B280ED91CBA4C62D01F95D3862FEEFC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  luxorrrrrrrrrrrrrr222rdefense_evasiondiscoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    lIMGS-chaturbateArgPetera/lIMGS-chaturbateArgPetera.pdf
  • Size 834KB
  • SHA256 91098b2228a469b6e2a04d56efbd0b0e35cf4ab05d6bd1e07b510a0e3ef7c91e
  • MD5 ff747a287ad92b53e120507bf307de45
  • SHA1 85d938fe5192e7524c2b5e4a906c149b7d7e070b
  • SHA512 d7ace615a4631d6cef5df75fcd83190b840eda8d0b81ff5554e78191f1c5ad4ce81cd1bf568a09c94ce5bbdf6aacdaf3eb2f6663d603c6177c82dadd95176561
  • SSDEEP 24576:kc1AYF3dh/JF65GjsXfB1AMVOf/1x/5PadtF:kc6mdPPkP5Of/1x/sdf
  • TLSH
    T1510523387685AD39A728922238BEE3084F89163B5EDC76C0D3C53C65D06EAD9B76071D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4