Extracted

Extracted

• • Target

    Hwid Spoofer Eac Rust Cleaner_nls.scr1

  • Size

    390KB

  • MD5

    004dd8842386a105607735a890f57235

  • SHA1

    9b1cb5e663cd342f1c44936c6db8540b6df0228b

  • SHA256

    8744ee78fd8ec700b2d27545ad32e1e28f38f07c272d61bbcb8cff147cfb9bda

  • SHA512

    95ac078482e9c3de3e0dc666322d2080a0a08443a0c5e2da848abcc45c5095e20dbd2e8cee6822eff13e4f98251e0e3b02c1ee4f70e0971d60eb56fa5f7de84c

  Score

  10^/10

  asyncratwindows session managerwindows system guard runtimepersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2