Extracted

• • Target

    AWB#5305323204641,pdf.exe

  • Size

    233KB

  • MD5

    88e05a7f3b27e3aed5d577949c867917

  • SHA1

    180a4cabbb5ea319ff1210f5686c7779d0dd58c7

  • SHA256

    f3b33a885af940210f10df7e1c96dc388161961dcb52b6d84c3b7458d20ce116

  • SHA512

    3d42bc7888584efea5d8a0a48b6293c54405d0186f3d8a45741f4e371ee143a5d1411be8f69dbe5aa5957b8dbad921100872206408a431849de4c826db875bbe

  Score

  10^/10

  asyncratmay11thupcoreentityratrezer0

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • Async RAT payload

    rat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2