Extracted

Extracted

• • Target
    117efcf6a3a3af167c293331a7531a46.exe
  • Size 714KB
  • SHA256 4eedc7ed6ade620eef8eb160d18518afc9c59eb262baf8a9fdbe758fb611b6f0
  • MD5 117efcf6a3a3af167c293331a7531a46
  • SHA1 876b3d74c8b535f6b90455b0f8a5d79ca33362e1
  • SHA512 4d2e44fd2024a50f3d43af5a003df207a0f31cfea02d7fbec9792ab2b6e016f41f6912c682cdc1870b08735e6ac4b6e12817cc2469ed9a531c89ee62e55157a8
  • SSDEEP 12288:gIUeoUmehPpnvcZvbEuLwhRgUjVZ6bgDkNReuXFWzPLK+V/BymbMijf6CPvwo:NFBvcoi6QRU9VZZbMijvvwo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratxwormzgratdefaultexecutionpersistenceratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Detect ZGRat V1

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2