Extracted

Extracted

Extracted

• • Target

    CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8

  • Size

    22.7MB

  • MD5

    55287c8aa442a3f521aabb6a80b3f6a8

  • SHA1

    5e9c38e66448c4c1b8066b04987eb62cf6f48763

  • SHA256

    cfb1ee668fc3e25580c334ab753749d2ef5a44ab9be1e033047345827696cbf8

  • SHA512

    2d265bb941c28944ae7a25dea43d6122e04e549d349fc8276670683926feac52b12d3de42b0601d134f3842641b28751a62c8ddc28e3a3140f2041dfdf629813

  Score

  10^/10

  asyncratnanocoreneshtaquasarmix21mixonediscoveryevasionkeyloggerpersistenceratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Detect Neshta Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Async RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2