Extracted

• • Target

    IMG-2983562837502856238572 IMPORTANTE CONFIRMACION DE TRANSFERENCIA 27 DE SEPTIEMBRE DEL 2022.exe

  • Size

    1.1MB

  • MD5

    63027acdb2e94bb2898f500e0cab0096

  • SHA1

    9cbfef38ce9f29573fa2ef3ef1b9ae1f48d86744

  • SHA256

    c9735d5cb6d553dbedcc04e9026961432607e01074aaa863cbd8e576760453cd

  • SHA512

    2dd3bab440c80bff02a831cb055666066dd6ae359554a81f6a72293d6b9d6fd06747e3325d0f03faffa78d9ebee769472c558f670ef8492348ed4446eb473ba3

  • SSDEEP

    24576:Yg5q8YY6KYuTZkpQpZzY9x9Pnnl6PVoPnP2IRfVYhsgWsa:v5j6UlvZzcx9Pl6PonPchhWz

  Score

  10^/10

  asyncratdefaultpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2