Extracted

• • Target

    2422867b94c312c95a0b658653edad874879c561cce4b57e4594cf90e46adc5f

  • Size

    916KB

  • MD5

    b568a443f327468c6aeca35087a2c7d7

  • SHA1

    344376e3455e987639103320562b64f393452c61

  • SHA256

    2422867b94c312c95a0b658653edad874879c561cce4b57e4594cf90e46adc5f

  • SHA512

    4062e6a811557cf089783764708b3fb8cb84987af5efd341e10109e7a288065aa20d281d82511e13c9a7a0d9cde0f4ca62c3de70c2cff3d2bcc27d86348c0ad9

  • SSDEEP

    12288:WKwjBPEVUsKvTPvfG77y0SszlLgBRV7he0A/VxoL1m0dZlWkiPRAQSQy4AB:jwjBcqGyNAL2VA0aiZddgpAtQy4A

  Score

  10^/10

  asyncratvenom clientsevasionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2