Extracted

Extracted

• • Target
    https://gtm.aryzap.com/lx_zip.php?t=lx301644c365dc

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratvioletwormpersistenceransomwareratspywareworm

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: VioletWorm

    VioletWorm is a Windows worm written in C#.

    wormvioletworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1