Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    fc21892aeb3c146f92a5721115252b5924c70494ae24460aa1d72c986aee2a36.exe

  • Size

    3.1MB

  • MD5

    f74eafefa6ec7e1e110e4a2dd78054e9

  • SHA1

    749ec2465671de48c0ba76732773a29c1a678d3b

  • SHA256

    fc21892aeb3c146f92a5721115252b5924c70494ae24460aa1d72c986aee2a36

  • SHA512

    8cdd0ed58955d64b0c749062d8f0e5fc0dec4ebed9f734193eb68681d2ab4064d0b753eafec72d91ec1e877eb47bd9e29fa9fe84e1cdae0104c40ef5cbd2b766

  • SSDEEP

    49152:WvFt62XlaSFNWPjljiFa2RoUYIXe8UbR4LoGdXTHHB72eh2NT:Wv362XlaSFNWPjljiFXRoUYIXe8b

  Score

  10^/10

  lummanjratquasarvidar158fdd2a4f5abb978509580715e5353fhackedoffice04credential_accesscryptonediscoverypackerspywarestealertrojanasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Njrat family

    njrat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • CryptOne packer

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2