Extracted

• • Target
    ilmg-Arg-Tetonassuk/ilmg-Arg-Tetonassuk.js
  • Size 894KB
  • SHA256 68bd8187d7cb679855efd146c7e52c6a0ea0b3251d345bfbb8556e963326bdd6
  • MD5 8f7915934814a476b2b2edbebaa518dc
  • SHA1 9a0361f7664da29569e2f309446d38feeea6144b
  • SHA512 9412754c4bd0deac1a7078cc33e3613630faa9b96834ba44fe61ebd0504e053b2926bd7b310cdc9830415c79be74b67a9c193f5bd25f2647404ec3b2a2df85da
  • SSDEEP 1536:7vyBXAfvGBGWEBRJ4+A59LzXAP4+LHGmhFhRnQaglGb7VSdlbYze7fyQ3HGWyumL:7IGWMXCZEMsk1q
  • TLSH
    T14915FB0573AF2423C6527072DFA7A2822E36454F2E47D46C7A5C80D82FA51AE817EF7D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sasxdiscoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    ilmg-Arg-Tetonassuk/kvauvqtsku.pdf
  • Size 4.8MB
  • SHA256 969bb7e0c6e23d031b74e6e6c908c1f65954f5503ea38a892e97ba59ae741939
  • MD5 8b50de3c1c255cca277b68a761e4e597
  • SHA1 e7f19dd4e8308b834f0f64502dc5e26457e7ae2e
  • SHA512 1ac844f530d0aaca6582ab15edaa3ec781df0ebddfd37f8ce83e3103555a956553d28635e065925ace7d0f952c2af94c980f342f330eb9d87e6c2ef5dca215b8
  • SSDEEP 98304:Jj3otJKpD+no8kYksBdWkTILYZ9PfxcOpLAGs97rzxvqn1:Jj3+oEo8kYhdWk3rfQ/xk1
  • TLSH
    T1CA3633E75320688A6FC66785C7D015847F3072714798D44372E81BEE0E6F85AFBA9A3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4